Data Link Layer

Data Link Layer

Data link layer deals with frames and it’s the
responsibility of the data link layer to move
frames from one node to another. Services
offered by this layer include • Framing
• Physical Addressing
• Flow Control
• Error control
Encapsulation and the Ethernet Frame

Encapsulation
 Each message is encapsulated into a specific format,
called a frame, that includes the source and
destination addresses.

• An example is how a letter is put (encapsulated)

inside an envelope.

For communication on an IP network, the format

is
very specific and includes a source and
destination
address.

Encapsulation and the Ethernet Frame

Ethernet Frame

On an Ethernet network, messages are put into a frame or Layer 2 protocol data units (PDUs).
4

Ethernet Frame
• PREAMBLE – Ethernet frame starts with a 7-Bytes
Preamble. PRE (Preamble) indicates to the receiver that
frame is coming and allow the receiver to lock onto the
 data stream before the actual frame begins.
• Start of frame delimiter (SFD) –SFD indicates that
upcoming bits are starting the frame, which is the
destination address. Sometimes SFD is considered part of
PRE, this is the reason Preamble is described as 8 Bytes
in many places. The SFD warns station or stations that
this is the last chance for synchronization.

Ethernet Frame
• Destination Address – This is a 6-Byte field that contains
the MAC address of the machine for which data is
destined.
• Source Address – This is a 6-Byte field that contains the
MAC address of the source machine. As Source Address
 is always an individual address (Unicast), the least
significant bit of the first byte is always 0.
• Length – Length is a 2-Byte field, which indicates the
length of the entire Ethernet frame. This 16-bit field can
hold a length value between 0 to 65534, but length
cannot be larger than 1500 Bytes because of some own
limitations of Ethernet.

Ethernet Frame
• Data – This is the place where actual data is inserted, also
known as Payload. Both IP header and data will be
inserted here if Internet Protocol is used over Ethernet.
The maximum data present may be as long as 1500 Bytes.
In case data length is less than minimum length i.e. 46
 bytes, then padding 0’s is added to meet the minimum
possible length.
• Frame Check Sequence – It’s a checksum that computes
the entire frame.

Ethernet MAC Addresses

• An Ethernet MAC address consists of a 48-bit binary value, expressed
using 12 hexadecimal values.
• Given that 8 bits (one byte) is a common binary grouping, binary
00000000 to 11111111 can be represented in hexadecimal as the
range 00 to FF,
• When using hexadecimal, leading zeroes are always displayed to
complete the 8-bit representation. For example the binary value 0000
1010 is represented in hexadecimal as 0A.
• Hexadecimal numbers are often represented by the value preceded
 by 0x (e.g., 0x73) to distinguish between decimal and hexadecimal
values in documentation.
• Hexadecimal may also be represented by a subscript 16, or the hex
number followed by an H (e.g., 73H).

Ethernet MAC Addresses

• In an Ethernet LAN, every network device is connected to the same,
shared media. MAC addressing provides a method for device
identification at the data link layer of the OSI model.
• An Ethernet MAC address is a 48-bit address expressed using 12
hexadecimal digits. Because a byte equals 8 bits, we can also say that a
MAC address is 6 bytes in length.
• All MAC addresses must be unique to the Ethernet device or Ethernet
interface. To ensure this, all vendors that sell Ethernet devices must
register with the IEEE to obtain a unique 6 hexadecimal (i.e., 24-bit or
3-byte) code called the organizationally unique identifier (OUI).
• An Ethernet MAC address consists of a 6 hexadecimal vendor OUI code
followed by a 6 hexadecimal vendor-assigned value.

Ethernet MAC Addresses

 Frame Processing
• When a device is forwarding a message to an Ethernet
 network, the Ethernet header include a Source MAC address
and a Destination MAC address.
• When a NIC receives an Ethernet frame, it examines the
destination MAC address to see if it matches the physical MAC
address that is stored in RAM. If there is no match, the device
discards the frame. If there is a match, it passes the frame up
the OSI layers, where the de-encapsulation process takes
place.
Note: Ethernet NICs will also accept frames if the destination
MAC address is a broadcast or a multicast group of which the
host is a member.

Frame Processing
Any device that is the source or destination of an Ethernet
frame, will have an Ethernet NIC and therefore, a MAC
address. This includes workstations, servers, printers,
 mobile devices, and routers.

Unicast MAC Address

•In Ethernet, different MAC addresses are used for Layer 2
unicast, broadcast, and multicast communications. • A unicast
MAC address is the unique address that is used
when a frame is sent from a single transmitting device to a
single destination device.
• The process that a source host uses to determine the
destination MAC address associated with an IPv4 address is
known as Address Resolution Protocol (ARP). The process that
a source host uses to determine the destination MAC address
associated with an IPv6 address is known as Neighbor
Discovery (ND).

Unicast MAC Address

• Note: The source MAC address must always be a unicast.
 Broadcast MAC Address
•An Ethernet broadcast frame is received and processed by
 every device on the Ethernet LAN. The features of an
Ethernet broadcast are as follows:
• It has a destination MAC address of FF-FF-FF-FF-FF-FF in
hexadecimal (48 ones in binary).
• It is flooded out all Ethernet switch ports except the
incoming port. It is not forwarded by a router. • If the
encapsulated data is an IPv4 broadcast packet, this means
the packet contains a destination IPv4 address that has all
ones (1s) in the host portion. This numbering in the address
means that all hosts on that local network (broadcast
domain) will receive and process the packet.

Broadcast MAC Address

Multicast MAC Address
•An Ethernet multicast frame is received and processed by a
group of devices that belong to the same multicast group. •
There is a destination MAC address of 01-00-5E when the
encapsulated data is an IPv4 multicast packet and a
destination MAC address of 33-33 when the encapsulated
data is an IPv6 multicast packet.
• There are other reserved multicast destination MAC addresses
for when the encapsulated data is not IP, such as Spanning
Tree Protocol (STP).
• It is flooded out all Ethernet switch ports except the incoming
port, unless the switch is configured for multicast snooping. It
is not forwarded by a router, unless the router is configured
to route multicast packets.

Multicast MAC Address

• Because multicast addresses represent a group of addresses
(sometimes called a host group), they can only be used as the
destination of a packet. The source will always be a unicast
address.
• As with the unicast and broadcast addresses, the multicast IP
address requires a corresponding multicast MAC address

Multicast MAC Address

Switch Fundamentals
 20

Switch Fundamentals
• A Layer 2 Ethernet switch uses Layer 2 MAC addresses to make
forwarding decisions. It is completely unaware of the data
(protocol) being carried in the data portion of the frame, such as an
IPv4 packet, an ARP message, or an IPv6 ND packet. The switch
makes its forwarding decisions based solely on the Layer 2 Ethernet
MAC addresses.
• An Ethernet switch examines its MAC address table to make a
forwarding decision for each frame.
• When a switch is turned on, the MAC address table is empty

•Note: The MAC address table is sometimes referred to as a content

addressable memory (CAM) table.

Switch Learning and Forwarding

•Examine the Source MAC Address (Learn)
•Every frame that enters a switch is checked for new information to
learn. It does this by examining the source MAC address of the frame
and the port number where the frame entered the switch. If the
source MAC address does not exist, it is added to the table along with
the incoming port number. If the source MAC address does exist, the
switch updates the refresh timer for that entry. By default, most
Ethernet switches keep an entry in the table for 5 minutes.

•Note: If the source MAC address does exist in the table but on a
 different port, the switch treats this as a new entry. The entry is
replaced using the same MAC address but with the more current port
number.

Switch Learning and

Forwarding (Contd.)
Find the Destination MAC Address (Forward)
•If the destination MAC address is a unicast address, the switch
will look for a match between the destination MAC address of the
frame and an entry in its MAC address table. If the destination
MAC address is in the table, it will forward the frame out the
specified port. If the destination MAC address is not in the table,
the switch will forward the frame out all ports except the incoming
port. This is called an unknown unicast.
•Note: If the destination MAC address is a broadcast or a
multicast, the frame is also flooded out all ports except the
incoming port.

The MAC Address Table

• As a switch receives frames from different devices, it is
able to populate its MAC address table by examining the
source MAC address of every frame. When the MAC
address table of the switch contains the destination MAC
address, it is able to filter the frame and forward out a
single port.
The MAC Address Table
Lab – View the Switch MAC
Address Table
• In this lab, you will complete the following
objectives:
• Part 1: Build and Configure the Network •
Part 2: Examine the Switch MAC Address
Table
ARP
ARP uses 3 steps to discover and store the MAC address of a host on the local network when only
the IPv4 address of that host is known.
1. The sending host creates and sends a frame addressed to a broadcast MAC address. Contained
in the frame is a message with the IPv4 address of the intended destination host.
2. Each host on the network receives the broadcast frame and compares the IPv4 address contained
in the message with its own IPv4 address. The host with the matching IPv4 address sends its own
MAC address back to the original sending host.
3. The sending host receives the message and stores the MAC address and the IPv4 address in an
ARP table.

41