Expressvpn Glossary
Data plane
What is the data plane?
The data plane (also called the forwarding plane) is the part of a network device that moves data packets from one place to another. It handles live traffic and works alongside the control plane, which decides how traffic should flow. The data plane applies those decisions by processing and forwarding packets in real time.
How does a data plane work?
When a packet arrives at a network device, the data plane checks its destination address against a forwarding table and takes the appropriate action:
- Forwarding the packet to the correct outgoing interface.
- Dropping the packet if it does not meet the defined criteria.
- Modifying packet headers, for example, during network address translation.
- Applying policies such as access control or Quality of Service (QoS) rules.
These steps are designed to happen quickly and consistently so that traffic flows without delay.
Data plane vs. control plane
The data plane and control plane have separate but related roles in network operation. The control plane builds the routing tables and policies, and the data executes them on live traffic.
| Feature | Data plane | Control plane |
| Function | Forwards packets | Determines routing paths |
| Role | Executes decisions | Creates and updates rules |
| Timing | Real-time processing | Periodic or event-driven |
| Examples | Packet forwarding, filtering | Routing protocols such as Open Shortest Path First (OSPF) and Border Gateway Protocol (BGP) |
| Security role | Enforces policies on live traffic | Distributes routing decisions |
Why is the data plane important?
The data plane directly determines how quickly and reliably a network handles traffic. Because every packet passes through it, inefficiencies or misconfigurations at this layer affect the whole network, resulting in delays and congestion.
The data plane also plays a key role in security. Systems such as firewalls and intrusion prevention systems (tools that inspect packets in real time to detect and automatically block malicious activity) all rely on the data plane to enforce traffic rules. Failure at this level can allow unwanted traffic to pass through.
Where is the data plane used?
The data plane is present in any system that forwards network traffic, including:
- Routers and switches: Physical and virtual devices that direct traffic between networks or segments.
- Cloud networks: Software-based infrastructure that handles traffic within virtual environments.
- Software-defined networking (SDN): Separates control logic from packet forwarding, often distributing data plane functions across infrastructure.
Risks and limitations
Issues in the data plane can affect both performance and security.
- Misconfigured forwarding rules can send traffic to the wrong destination.
- Weak packet filtering can allow malicious traffic through.
- High traffic volumes, such as distributed denial-of-service (DDoS) attacks, can overwhelm forwarding capacity, causing packet loss or delays.
- Limited visibility into packet processing can make some threats harder to detect.
Further reading
- DoS vs. DDoS attacks: Key differences and how to protect yourself
- What is the IKEv2 VPN protocol?
- What is routing, and why does it matter in networking?
- Deep packet inspection (DPI): How it works and why it matters
- What is a firewall and why it matters for security
