Before you read. Two buildings, four hundred desks, a server room in one of them, and somebody has asked you for a drawing before anything is ordered.
Every shape you could choose will work. They differ in what they cost, what happens when one box dies, and which of them you can still afford to extend in five years.
Which shape, and what is the argument for it?
This topic is vocabulary with consequences. The words are easy and the exam tests them directly, so most material stops at the definitions. The part worth having is the arithmetic underneath, because it explains both why one shape won and why the shape every textbook still teaches first has quietly been abandoned in the place it was invented for.
Some words you will need
- topology
- The shape of the connections. Physical topology is the cabling, logical topology is how traffic actually flows, and they are frequently different.
- hub and spoke
- Many sites each connected back to one central site, and to nothing else.
- mesh
- Devices connected to each other directly. Full mesh means every one to every other; partial mesh means some of them.
- three-tier
- Core, distribution and access as three layers of switching, each with a different job.
- collapsed core
- The same design with core and distribution done by one pair of devices.
- spine and leaf
- Two layers, where every leaf connects to every spine and leaves never connect to each other.
- oversubscription
- The ratio between what the edge can offer and what the layer above can carry.
What breaks without this
You cannot read a diagram somebody hands you. Every network you inherit arrives as a drawing using these words, and the words are load bearing: calling something a collapsed core tells the next person where the routing happens.
A design gets chosen by accident. Nobody sits down and picks a hub and spoke. It happens by adding sites to whichever one had the internet connection, and it is only a problem the day two branches need to talk to each other.
You buy the wrong number of uplinks. Oversubscription is arithmetic that can be done on paper before anything is ordered, and it is the single most common thing missing from a design that later gets described as slow.
The shapes, and what each one costs
Start with the two extremes, because everything in production sits between them.
A star puts one device in the middle and everything else on a spoke. Every switch you have ever seen is a star: the switch is the middle and the desks are the points. It is cheap, it is easy to reason about, and the middle is a single point of failure for everything attached to it.
A full mesh connects every device directly to every other. Nothing has a single point of failure and the link count is the problem. Six devices need fifteen links, eight need twenty-eight, and twenty need a hundred and ninety. The count grows as the square of the device count, which is why a full mesh of anything larger than a handful of sites exists in exam questions and almost nowhere else.
Between them sit the two that are actually built.
Hub and spoke is a star drawn at the scale of buildings: branches connect to head office and not to each other. Traffic between two branches goes via the middle, which is fine for branches that mostly talk to head office and painful the day they need to talk to each other.
Partial mesh adds direct links only where the traffic justifies them. That is what most wide area networks actually are, and the design work is deciding which handful of extra links to buy.
Point to point is the degenerate case, two devices and one link, and it is worth naming because the exam does. A leased line between two buildings is a point to point link whatever runs over it.
If you already design these: why almost nothing in production is one shape
The named topologies are a vocabulary rather than a menu, and the useful skill is seeing which one applies at which scale of the same network.
Take any office. The desks around a switch are a star. Those switches uplinked to a pair above them are another star, or a partial mesh if each uplinks to both. The two sites joined by a pair of circuits are a partial mesh again at a different scale. Nobody chose a topology for that building; three of them are present because each level had a different constraint.
Which is why an argument about whether a design is a star or a mesh usually means the scale has not been stated. The question worth asking instead is what fails when one thing fails, and that has an answer at every level: one desk, one floor, one site.
The other thing the shapes conceal is that resilience is not symmetric with cost. Going from no redundancy to one redundant path removes the single point of failure and is where nearly all the benefit is. Going from one to two costs as much again and buys the much rarer double failure. Most estates are two links deep at the core, one link deep at the access layer, and that split is a deliberate reading of where the money is worth spending rather than an inconsistency.
The design every textbook teaches
The three-tier hierarchical model divides switching into layers with different jobs, and for twenty years it was simply how enterprise networks were drawn.
Access is where things plug in. Ports for desks, phones and access points, and this layer is where the port count lives.
Distribution aggregates the access switches for an area, usually a floor or a building. It is where routing between VLANs happens, and where policy gets applied, because it is the first layer that sees traffic from more than one access switch.
Core connects the distribution layers to each other at speed and does as little else as possible. The design rule everyone quotes is that the core should switch and route and nothing more: no access lists, no policy, nothing that requires it to think.
A collapsed core merges core and distribution into one pair of devices. That is the right answer for most buildings, because the three-layer version exists to solve a scale problem that a single site with four hundred desks does not have. Calling it a collapsed core rather than a two-tier network tells the next person that the distribution layer’s jobs still happen, they just happen on the same boxes as the core.
If you already work on networks: why the layers exist at all, and the argument RFC 3439 makes against being clever
The hierarchy is usually justified with the word scalability, which explains nothing. The real argument is about failure domains and about how much any one device has to know.
A flat switched network is one broadcast domain and one spanning tree. Every switch participates in every topology change, every broadcast reaches every port, and the failure domain is the whole site. Splitting it into layers puts a routing boundary between areas, which bounds all three: a topology change at the access layer stays there, and a broken switch takes out a floor rather than a building.
The second argument is about device roles. An access switch needs many cheap ports and very little intelligence. A core switch needs few ports, enormous throughput, and no features at all. Those are different products with different prices, and a design that mixes the roles ends up buying core-class hardware for desk ports.
RFC 3439 is worth reading here even though it is about the internet rather than about campus design, because it names the underlying principle and does it bluntly. Its Simplicity Principle argues that complexity is the thing that limits scaling, and that the cost of a system grows faster than its complexity does. The document is unusually direct for an RFC and contains a section called “Architectural Component Proportionality Law”. The reason to bring it into a campus discussion is that the strongest argument for the three-tier model is not that it is fast. It is that each layer is simple enough to be reasoned about alone.
Which is also the argument against applying it everywhere. Three layers in a building that needs two is complexity bought for nothing, and the same RFC would say so.
The design that replaced it, and where
Spine and leaf has two layers and one rule: every leaf connects to every spine, and leaves never connect to each other. Traffic from any leaf to any other leaf crosses exactly one spine, so every pair of devices is the same distance apart. That property has a name, which is equidistance, and it is the entire point.
It is not a new idea. The structure is a Clos network, described by Charles Clos at Bell Labs in 1953 for telephone switching, and rediscovered when data centres started having the same problem: how to build a large non-blocking fabric from small elements.
The reason it displaced three-tier in the data centre is a change in what the traffic does, which the next section is about. The reason it has not displaced three-tier in office buildings is that an office does not have that problem. Four hundred desks talking to a handful of servers and the internet is exactly the traffic pattern three-tier was designed around.
RFC 7938 is the document to know exists. It describes running BGP as the routing protocol inside a large data centre fabric, and its early sections explain why the Clos topology was chosen and what properties it has. It is free, it is readable, and it is a primary source for a subject that is otherwise covered entirely by vendor marketing.
If you already work on networks: oversubscription, and the number that decides whether a design works
Oversubscription is the ratio between what a layer could receive and what it can forward, and it is the arithmetic that separates a design from a drawing.
Take one access switch: 48 ports at 1 Gbps, so 48 Gbps of edge capacity, with two 10 Gbps uplinks, so 20 Gbps upward. That is 48 to 20, which reduces to roughly 2.4 to 1. If every port transmitted at line rate simultaneously, more than half of it would have nowhere to go.
That is not a fault. Oversubscription is deliberate, because desks do not all transmit at once and building for the worst case would cost several times more for capacity that is never used. The design question is what ratio is acceptable, and the honest answer is that it depends entirely on what the ports do. Desks running email and web tolerate a high ratio comfortably. A rack of servers replicating storage does not tolerate one at all.
The published conventions, and they are conventions rather than standards, put access to distribution around 20 to 1 and distribution to core around 4 to 1 in a campus. Data centre fabrics aim considerably lower, frequently 3 to 1 and sometimes 1 to 1 for storage, which is what non-blocking means when a vendor says it.
Two things make this worth doing on paper before ordering. The ratio changes when port speeds change, so upgrading desks from 1 to 2.5 Gbps multiplies the oversubscription by 2.5 without anybody touching the uplinks. And the symptom of a bad ratio is not an error anywhere. It is a network that is fine most of the time and slow during backups, which gets diagnosed as almost anything else first.
North-south and east-west
The two terms describe direction of travel relative to a drawing where the outside world is at the top.
North-south is traffic between a client and something outside its own layer: a desk reaching the internet, a laptop reaching a server, anything that goes up through the hierarchy and back down.
East-west is traffic between devices at the same level: server to server, one virtual machine to another, one storage node to its replica.
The distinction matters because the three-tier model was built when almost everything was north-south. Users at the edge, servers in the middle, and very little reason for two servers to talk to each other. Under that pattern a design that funnels traffic upward is exactly right.
Then applications stopped being one program on one server. A single request now fans out across services, each on a different machine, each with a database and a cache and a message queue, and every one of those hops is east-west. In a three-tier design two servers on different access switches talk to each other by going up to distribution and possibly to core and back down, which means the layer built to be simple and fast is now carrying the majority of the traffic and adding hops to all of it.
Spine and leaf answers that directly. Every leaf is one spine from every other leaf, so east-west traffic takes the same path length wherever it goes, and adding capacity means adding a spine rather than redesigning a hierarchy.
Which is the answer to the question at the top of this page. Two buildings and four hundred desks is a north-south problem, and the right drawing is a collapsed core in each building with a link between them. Nothing about that site benefits from a spine and leaf fabric, and proposing one would be answering a question nobody asked.
Prove it
This topic has nothing to capture. Topology is a property of how things are cabled, and a namespace has no cabling worth the name. So the evidence takes the form the cabling topics used: read a named document and answer a question only that document answers.
RFC 7938, sections 3 and 4. Free from the RFC editor. Read the discussion of why a Clos topology was chosen for large data centres and answer one question: what property does the document say the topology gives you that a hierarchical design does not, and which layer of a Clos fabric do you add to when you need more capacity between servers?
RFC 3439, section 2. Read the Simplicity Principle and answer a narrower question: does the document argue that complexity should be minimised because it is expensive, or because it limits how far a system can scale? The distinction is the whole argument and most summaries get it backwards.
Then do the thing that costs nothing. Find the network diagram for wherever you work. Count the layers between a desk and a server. If the answer is more than three, ask why, and if the answer is that nobody knows, you have found something worth writing down.
What trips people up
1. Confusing physical topology with logical topology
The cabling and the traffic flow are different drawings and frequently disagree. A network cabled as a star can behave as a logical ring, and a wireless network with no cables at all still has a topology. When a question says topology, check which one it means.
2. Treating full mesh as an aspiration
It is not the ideal that budget prevents. The link count grows as the square of the device count, so a full mesh is unbuildable past a handful of sites and would be a maintenance problem if it were not. Partial mesh is the answer, and choosing which links to add is the actual design work.
3. Calling a two-tier network a collapsed core when it is not
A collapsed core does the distribution layer’s jobs on the core devices: routing between VLANs, policy, aggregation. Two switches in a row with no routing between them is not a collapsed core, it is a flat network with an uplink, and the distinction matters when somebody asks where a rule should go.
4. Assuming spine and leaf is simply better
It is better for east-west traffic in a fabric large enough to have that problem. In a building where four hundred desks talk to the internet, it costs more, adds no capability, and gives you more devices to maintain. The shape follows the traffic.
5. Reading north-south and east-west as physical directions
They describe position in a hierarchy rather than geography. Two servers in different buildings talking to each other is east-west traffic, even though the packets travel between sites.
6. Ignoring oversubscription until it is a fault
The ratio is arithmetic anybody can do on paper before anything is bought, and its symptom later is a network that is fine except when it is busy. Nothing reports an error, which is why it is diagnosed last.
Work it through
The site from the top of this page, and the reasoning in the order it should happen.
Start with the traffic, not the shape. Four hundred desks, one server room, an internet connection. Almost every packet goes from a desk to a server or to the internet, which is north-south, and there is very little reason for two desks to talk to each other at all. That single observation eliminates spine and leaf before any cost is discussed.
Now the layers. Four hundred desks needs access switching in wiring closets on each floor, which topic 13 established comes from the 100 metre limit rather than from any design preference. Those access switches need aggregating. Whether that aggregation layer is separate from the core is the only real question, and for one site of this size it is not: a collapsed core, meaning a pair of switches doing distribution and core together, is the defensible answer. A pair, not one, because the whole point of the middle is that everything depends on it.
The second building changes one thing. It needs its own access switching and its own aggregation, because the alternative is running desk cable between buildings, which the distance limit forbids. So the shape is two collapsed cores with a link between them, and that link is a point to point connection whatever technology carries it.
Then the number nobody asks for. Twelve access switches at 48 ports each, uplinked at 2 by 10 Gbps, gives roughly 2.4 to 1 per switch and 240 Gbps arriving at the collapsed core if everything shouted at once. It will not, but the core pair has to be sized against a plausible fraction of it rather than against the average, and writing that number down is what turns a drawing into a design.
What is left is redundancy, and it is worth being explicit rather than assuming it. Two core switches, two uplinks from each access switch, one to each core. That is a partial mesh between the layers, and it means any single switch or any single uplink can fail without taking a floor down. It also means spanning tree has a loop to break, which is topic 19 arriving in a design conversation.
Try it
Draw your own network from memory, then check it. Sketch the shape you think it has, then find the real diagram. The difference between the two is the part you did not understand, and it is worth more than the sketch.
Do the oversubscription arithmetic for one switch. Port count times port speed, divided by uplink capacity. It takes a minute and most people have never done it for equipment they own.
Read RFC 7938’s first four sections. Twenty minutes, free, and it is the only primary source most people will ever read on data centre topology.
Check yourself
Why does a full mesh stop being buildable so quickly, and what replaces it?
Because the link count grows as the square of the number of devices. Connecting every device to every other needs n times n minus one, over two, links: six devices need fifteen, ten need forty-five, twenty need a hundred and ninety.
Partial mesh replaces it. Direct links are added only between the pairs whose traffic justifies the cost, and everything else routes through them. Choosing which pairs is the design work, and it is a traffic question rather than a topology one.
What is a collapsed core, and when is it the right answer?
It is a three-tier design with the core and distribution layers performing on the same pair of devices, so routing between VLANs, policy and aggregation happen there rather than on a separate layer.
It is right for a single site that does not have the scale problem the third layer exists to solve, which covers most office buildings. Three layers in a building that needs two buys complexity and no capability.
The word collapsed is doing real work. It says the distribution layer’s jobs are still happening, which tells the next engineer where to look for the routing.
Two servers in the same rack exchange a large amount of data. Why does that argue against a three-tier design?
Because that traffic is east-west, and three-tier funnels traffic upward.
Two servers on different access switches reach each other by going up to distribution, possibly to core, and back down. The layers built to aggregate a mostly north-south load are now carrying the bulk of the traffic and adding hops to every bit of it.
Spine and leaf answers it directly: every leaf is exactly one spine away from every other leaf, so any two servers are the same distance apart regardless of which rack they are in.
An access switch has 48 ports at 1 Gbps and two 10 Gbps uplinks. What is the oversubscription ratio, and is it a problem?
Forty-eight gigabits of edge against twenty gigabits of uplink, so roughly 2.4 to 1.
Whether it is a problem depends entirely on what is plugged in. For desks it is comfortable, because they do not all transmit at once and building for the worst case would cost several times more for capacity nobody uses. For a rack of servers replicating storage it is not acceptable at all.
The thing to watch is that the ratio moves when port speeds change. Upgrading those desks to 2.5 Gbps multiplies the oversubscription by 2.5 without anybody touching an uplink.
What does RFC 3439's Simplicity Principle actually argue, and why does it belong in a topology discussion?
That complexity is what limits scaling, rather than merely being expensive. The document argues that the cost and difficulty of a system grow faster than its complexity does, which makes simplicity a scaling property and not a preference.
It belongs here because the usual justification for the three-tier model is scalability, stated as though more structure means more scale. The RFC’s argument is the opposite and it is the better one: the layers are worth having because each is simple enough to be reasoned about on its own, and that is also the reason not to add a third layer to a site that needs two.
Why is spine and leaf described as equidistant, and what does that buy?
Because every leaf connects to every spine and no leaf connects to another leaf, so a packet from any leaf to any other crosses exactly one spine. Every pair of devices is the same number of hops apart.
What it buys is predictability. Latency between two machines does not depend on which rack they are in, so placing a workload becomes a capacity decision rather than a topology one. Adding capacity means adding a spine, which increases the bandwidth between every pair of leaves at once, instead of redesigning a hierarchy.
References
- RFC 7938 - IETF, on using BGP inside large data centres, whose early sections explain the Clos topology and why it was chosen. Free. Accessed 2026-08-11.
- RFC 3439 - IETF, on architectural guidelines, and the source of the Simplicity Principle quoted above. Free. Accessed 2026-08-11.
- IEEE 802.1Q - IEEE Standards Association, for the bridging behaviour the access layer depends on. Scope readable without purchase. Accessed 2026-08-11.
Where the numbers came from. Nothing on this page is captured, because a topology is a property of cabling and a namespace has none. The link count arithmetic is arithmetic. The oversubscription ratios described as conventions are exactly that: widely repeated design guidance from vendors rather than figures from a standard, which is why the panel says so rather than presenting them as requirements. The Clos attribution is to Charles Clos at Bell Labs in 1953, and RFC 7938 is the free document that connects that work to what data centres build now.
If you also work on Linux. Nothing here has a Linux counterpart. A machine knows its own links and its own routes and has no visibility of the shape it sits inside, which is precisely why topology has to be documented rather than discovered.