Computer Networking 1

Data Link Layer and Ethernet Switching

Submitted by
Lumagbas
Montaño
Mariñas
Tawat
Genio

Submitted to
Joemarie Heradura
Professor

Submitted on
04-24-2025
Module 6: Data Link Layer

6.1 Purpose of the Data Link Layer

The Data Link Layer plays a vital role in ensuring the reliable transmission of data across
physical network connections. It handles key tasks such as framing, MAC address-based
addressing, error detection, and media access control. This layer allows direct communication
between devices within the same network by wrapping higher-layer data—typically an IP packet
—into frames suitable for transmission. This module covers both physical topologies (like bus,
ring, star, and point-to-point) and logical topologies, which describe the flow of data between
devices and may differ from the physical arrangement. Overall, the Data Link Layer is crucial
for managing local data transfer, incorporating essential error-checking and flow control
mechanisms.

6.2 Topologies

There are two main types of topologies discussed in this section: physical topologies and logical
topologies. Physical topologies describe the actual physical connections between devices (e.g.,
bus, star, ring, and point-to-point), while logical topologies explain how data flows between
devices, which may not always match the physical layout. Multi-access networks (such as
Ethernet and Wi-Fi) require additional media access control to manage multiple devices sharing
the same communication medium. Comparing differences, point-to-point networks do not have
to manage multiple devices and are simpler.

6.3 The Data Link Frame

6.3.1 The Frame

In this part, we learn that a data link frame is composed of three main parts: a header, data, and a trailer.
The header contains addressing and control information, the data field encapsulates the Layer 3 packet
(usually an IP packet), and the trailer is used for error detection (typically via Cyclic Redundancy Check,
or CRC). The frame structure ensures that data can be transmitted effectively over a local network. The
size and structure of the frame can vary depending on the network’s environmental needs. For example,
wireless networks require more control information in the header and trailer compared to Ethernet frames
due to the potential for interference and the need for collision avoidance.

6.3.2 Frame Fields

Data link frames consist of several essential fields that organize and manage communication. These
include start and stop flags that mark the beginning and end of a frame, addressing fields that identify the
source and destination nodes, and a type field that specifies the Layer 3 protocol in use. Control fields
manage aspects like flow control and Quality of Service (QoS), while the data field carries the actual
payload. For error detection, fields such as the Frame Check Sequence (FCS) or Cyclic Redundancy
Check (CRC) are included. The trailer, found at the end of the frame, contains these error-checking codes
to verify that the frame has been transmitted accurately.

6.3.3 Layer 2 Addresses

The Data Link Layer uses physical addresses (MAC addresses) to deliver frames across the local
network. A MAC address is a unique identifier assigned to each network interface card (NIC) on the
network. Unlike IP addresses (Layer 3), which can be routed across multiple networks, MAC addresses
are used strictly for local communication and do not provide information about the network’s topology.
This means that Layer 2 addresses are used for identifying devices within the same network, but as data
moves through different networks, the MAC address is replaced with the appropriate Layer 3 IP address.

6.3.4 LAN and WAN Frames

The Data Link Layer functions differently in LAN and WAN settings. In local area networks (LANs),
Ethernet is the most widely used protocol, while 802.11 (Wi-Fi) is commonly used for wireless
communication. In wide area networks (WANs), older protocols such as Point-to-Point Protocol (PPP),
High-Level Data Link Control (HDLC), Frame Relay, Asynchronous Transfer Mode (ATM), and X.25
were once prevalent but have largely been replaced by Ethernet. The selection of a protocol is influenced
by the network’s logical topology, physical media, size, and bandwidth requirements. LANs generally
utilize high-bandwidth technologies, whereas WANs often rely on more economical solutions suited for
long-distance transmission.

Module 7: Ethernet Switching

Why should I take this module?

This module introduces Ethernet Switching, a key topic for aspiring network administrators
and network architects. It highlights Ethernet as one of the most widely used LAN
technologies.

Ethernet Frames: 7.1

7.1.1 Ethernet Encapsulation

This section introduces Ethernet technology, covering the MAC sublayer and Ethernet frame
fields. Ethernet, a key LAN technology alongside WLANs, uses wired communication
methods like twisted pair, fiber-optic, and coaxial cables. It operates at the data link and
physical layers, and is standardized by IEEE(Institute of Electrical and Electronics
Engineers) 802.2 and 802.3. Ethernet supports data rates from 10 Mbps to 100 Gbps.
7.1.2 Data Link Sublayers

● The Logical Link Control (LLC) sublayer, defined by IEEE 802.2, connects the upper-

layer network software with the lower-layer hardware. It identifies the network layer
protocol in each frame, allowing multiple Layer 3 protocols like IPv4 and IPv6 to share
the same network interface.

● The Media Access Control (MAC) sublayer, defined by standards like IEEE 802.3,

802.11, and 802.15, is implemented in hardware. It manages data encapsulation, media

access control, and addressing, working closely with different physical layer
technologies.

7.1.3 MAC Sublayer

The MAC sublayer is responsible for data encapsulation and media access. In encapsulation,
it builds the Ethernet frame, adds MAC addresses for source and destination, and includes a
Frame Check Sequence (FCS) for error detection.

7.1.4 Ethernet Frame Fields

Ethernet frames have a minimum valid size of 64 bytes and typically a maximum of 1518 bytes,
not including the preamble. Frames smaller than 64 bytes, referred to as collision fragments or
runt frames, are considered invalid and are discarded. When a frame carries more than 1500
bytes of payload, it's known as a jumbo frame or baby giant frame—these are only accepted if
the network infrastructure supports them. Any frame that falls outside the acceptable size range
is treated as invalid and is usually dropped by receiving devices, often due to network collisions
or signal transmission errors.
Module 7.2 Ethernet Mac Address

7.2.1 MAC Address and Hexadecimal

● IPv4 addresses use the familiar decimal (base ten) and the fundamental binary (base
two) systems.

● IPv6 addresses and Ethernet MAC addresses employ the hexadecimal (base sixteen)
system.

● Hexadecimal uses digits 0-9 and letters A-F to represent values.

● A crucial reason for using hexadecimal for Ethernet MAC addresses (which are 48-
bit binary) is its efficiency: one hexadecimal digit represents four binary bits.

● This allows a 48-bit MAC address to be written using only 12 hexadecimal

characters, making it much more manageable than 48 binary digits.

Example:

4 Bit
8-bit

7.2.2 Ethernet MAC Address

In an Ethernet network, MAC addresses are 48-bit identifiers (represented as 12 hexadecimal
digits) that uniquely identify network interface cards (NICs) within a local network. The first 24
bits, known as the Organizationally Unique Identifier (OUI), are assigned to manufacturers by
the IEEE. The remaining 24 bits are uniquely assigned by the vendor to individual devices. This
structure is designed to guarantee a globally unique MAC address for each Ethernet device.
However, duplicate MAC addresses can occasionally arise due to configuration errors or
deliberate alterations.

an Ethernet MAC address consists of a 6 hexadecimal vendor OUI code followed by a 6

hexadecimal vendor-assigned value

7.2.3 Frame Processing

A MAC address, also known as the burned-in address (BIA), is permanently embedded in the
read-only memory (ROM) of a Network Interface Card (NIC).

When a computer powers on, the NIC loads this MAC address into its random-access memory
(RAM).

When a device transmits data on an Ethernet network, the Ethernet frame includes both the
source MAC address (from the sender’s NIC) and the destination MAC address (intended
receiver’s NIC).

Upon receiving a frame, a NIC compares the destination MAC address with its own. If they
don’t match, the frame is ignored; if they do match, the frame is passed along to the higher layers
of the OSI model for further processing.

NICs are also designed to accept frames sent to a broadcast address or to any multicast group
they belong to.

In short, every device participating in Ethernet communication—whether it’s a computer,

server, printer, mobile device, or router—has a MAC address tied to its Ethernet NIC.

7.2.4 Unicast MAC Address

A unicast MAC address uniquely identifies a specific network interface card (NIC) on an
Ethernet network and is used for direct, one-to-one communication between devices. When a
device needs to send data to a particular recipient, it wraps the data in an Ethernet frame and
includes the recipient’s unicast MAC address in the frame’s header. Only the NIC with a
matching MAC address will accept and process the frame, while all others ignore it. This method
ensures that network traffic is efficiently delivered to the intended device without affecting
others on the same local network.

7.2.5 Broadcast MAC Address

The broadcast MAC address, denoted as FF-FF-FF-FF-FF-FF, is a special address used to enable
one-to-all communication within a local Ethernet network segment. When a device sends an
Ethernet frame with this address as the destination, the connected network switch broadcasts the
frame to all active ports—except the one it was received on. As a result, every device on the
local network receives and processes the broadcast frame. This approach is crucial for certain
network operations, such as the Address Resolution Protocol (ARP), where a device needs to
discover the MAC address associated with a specific IP address, or for initial discovery
processes where devices introduce themselves to the network.

7.2.6 Multicast MAC Address

Ethernet multicast enables one-to-many communication where a frame is sent to a specific group
of devices on the local LAN that belong to the same multicast group. For IPv4 multicast, the
destination MAC address typically starts with 01-00-5E, while IPv6 uses 33-33. Other multicast
MAC addresses exist for non-IP protocols. Switches will flood multicast frames like broadcasts
unless configured with multicast snooping to forward only to group members. Routers generally
don't forward multicast unless explicitly configured to do so. IP multicast uses a specific range of
IP addresses (224.0.0.0 - 239.255.255.255 for IPv4, ff00::/8 for IPv6), which are always
destination addresses, with the source being a unicast address. A corresponding multicast MAC
address is necessary for local network delivery, derived from the IP multicast.

Summary Table

Type Purpose Destination MAC Who Receives Router Behavior

Address

Unicast One-to-one Unique device MAC One specific Forwarded normally

device

Broadcas One-to-all FF-FF-FF-FF-FF-FF All devices on Not forwarded

t (local) LAN

Multicast One-to-many 01-00-5E (IPv4) / 33- Devices in Not forwarded

(group) 33 (IPv6) multicast group (unless enabled)

The MAC Address Table: 7.3

Switch Fundamentals

Ethernet switches use Layer 2 MAC addresses to make forwarding decisions for network
frames. Unlike hubs that broadcast all data to every port, switches check their MAC address
table to determine the correct output port for each frame. Switches do not interpret the data
portion of the frame (like IPv4, ARP, or IPv6); they focus only on the source and destination
MAC addresses.

Switch Learning and Forwarding

Learn:

When a frame enters a switch, the switch checks the source MAC address and the incoming
port. If the MAC address is new, it is added to the MAC address table with the port number. If
it already exists, the switch refreshes the timer for that entry. Typically, entries remain in the
table for 5 minutes by default.

Forward:

When a switch receives a frame with a unicast destination MAC address, it checks its MAC
address table for a match. If found, the frame is forwarded out the corresponding port. If not
found, the frame is flooded out all ports except the one it came in on—this is known as an
unknown unicast.
Filtering Frames

PC-D to Switch

A switch builds its MAC address table by examining the source MAC address of incoming
frames. Once the table includes the destination MAC address, the switch can filter the frame
and forward it through the correct single port.

Switches to PC-A

Because the switch has destination MAC address for PC-A in the MAC Address Table, it will
send the frame only out port 1, as shown in the figure
PC-A to Switch to PC-D

PC-A sends another frame to PC-D, as shown in the figure. The MAC address table already
contains the MAC address for PC-A; therefore, the five-minute refresh timer for that entry is
reset. Next, because the switch table contains the destination MAC address for PC-D, it sends the
frame only out port 4.