The Data Link Layer

1Recap5 min

Learning outcomes

• Explain the role of layer 2 and its division into the LLC and MAC sublayers
• Read an Ethernet frame field by field and say what each is for
• Recognise a unicast, multicast or broadcast MAC address
• Explain CSMA/CD and say why it has disappeared from modern networks
• Correctly count the collision and broadcast domains in a topology
• Describe the three actions of a switch: learning, forwarding, flooding
• Compare store-and-forward and cut-through switching

2What the physical layer lacks7 min

The physical layer manages a stream of bits. That is all. It has three important shortcomings, and layer 2 exists precisely to make up for them:

3The two sublayers: LLC and MAC7 min

Layer 2 sits exactly at the boundary between hardware and software, so it was divided into two sublayers, each looking in a different direction.

4Encapsulation at layer 27 min

For data to reach the right recipient, extra information is needed, and it is added by layer 2 and organised into frames. Most layer 2 protocols - not Ethernet alone - use the same set of fields:

Other layer 2 protocols you will meet in WANs: PPP, Frame Relay, ATM, and historically Token Ring. All of them solve the same problems, with different trade-offs.

5The Ethernet frame, field by field12 min

The structure of the frame is almost identical for every Ethernet implementation, from 10 Mbps to 100 Gbps. This is a remarkable feat of engineering: the speed has grown ten thousandfold and the format has stayed.

6The MAC address10 min

Ethernet identifies each interface by a 48-bit address, written in hexadecimal. It is written into the ROM of the network card at the factory.

The MAC address has two essential properties, both with direct consequences for what follows in the course:

1. It is flat - it contains no hierarchy whatever. From the address 00:FC:42:3E:34:99 absolutely nothing can be deduced about where that card is.
2. It has local scope - it is visible and usable only inside the broadcast domain. Beyond the first router, nobody sees it any more.

The three types of address

7The characteristic times of an Ethernet network7 min

Three time quantities explain nearly all the "odd" values in the Ethernet standard.

The interframe gap has a different role: it gives slow hosts time to process the current frame and prepare for the next. At 1 Gbps it means 96 nanoseconds - an eternity for the electronics, nothing at all for the traffic.

8The shared medium and CSMA/CD12 min

Ethernet was designed for a multiple-access medium: a single coaxial cable to which every host was attached. In such a medium two hosts may begin transmitting at exactly the same moment, and their signals overlap. The result is called a collision, and the frames involved become unusable.

9Collision and broadcast domains9 min

10How a switch works13 min

Here is the most elegant part of the whole lecture. Nobody configures a switch with the map of the network: it builds it itself, from a single clever observation.

The associations are kept in the CAM table (Content Addressable Memory), also called the MAC address table. For every frame received, the switch always performs the same two steps, in this order:

1. Learning. It reads the source MAC. If it is not in the table, it adds the pair (source MAC, ingress port). If it is already there, it resets its age counter.
2. Forwarding. It reads the destination MAC and looks it up in the table. Three outcomes are possible:
   • found, on a different port → unicast: send the frame out of that port alone;
   • found, on the ingress port itself → drop: the destination is on the same side, so resending would be pointless;
   • not found, or a broadcast/multicast address → flood: send it out of every port except the one it came in on.

Ageing of entries

Each entry in the table has an age associated with it, reset by every frame received from that address. When the age exceeds a threshold - 300 seconds by default on Cisco equipment - the entry is deleted.

11Switching methods6 min

How long does a switch wait before making its decision? There are three answers, with three different trade-offs.

The trade-off is plain: the more the switch reads before deciding, the better it filters, but the longer it delays.

12The Ethernet family, in brief5 min

Ethernet appeared in 1973 at Xerox PARC, built by Bob Metcalfe and David Boggs, with a bandwidth of 2.94 Mbps. The name comes from "ether" - the hypothetical substance through which light was once believed to propagate. In 1983 the IEEE turned the industrial DIX standard (DEC–Intel–Xerox) into the 802.3 standard, which holds to this day.

13Common mistakes4 min

• "The switch learns from the destination MAC address" It does not. It learns exclusively from the source address - the only one that says for certain where the frame came from. The destination is used only to decide where to send it. Remember the order: first learn from the source, then look up the destination.
• "A broadcast frame is also sent back out of the ingress port" Never. Flooding means "out of every port except the one it came in on". Otherwise an instant loop would be created, even with no redundant cables.
• "The 64-byte minimum size is an arbitrary convention" It comes straight from the slot time: the host must still be transmitting when the collision gets back to it. 64 bytes = 512 bit times = the slot time at 10 and 100 Mbps.
• "A 24-port switch has 24 broadcast domains" It has 24 collision domains and a single broadcast domain. A switch separates collision, but extends broadcast. Separating broadcast takes a router - or VLANs, in lecture 4.
• "The FCS corrects errors" It only detects them. A frame with a bad FCS is discarded, and retransmission is the business of the upper layers. Detection at layer 2, recovery at layer 4.

14Summary and glossary5 min

1. Layer 2 adds what the physical layer lacked: identity (MAC addresses), delimitation (frames) and error detection (the FCS).
2. The MAC address is flat and local - two limitations that make layer 3 necessary.
3. CSMA/CD solved the problem of the shared medium; full-duplex switching made it unnecessary.
4. A switch builds the map of the network by itself, from the source MAC addresses of the frames that pass through it.
5. A switch separates collision domains and extends broadcast ones - and the whole of the next lecture starts from there.

15Self-check questions6 min

16Further reading and bibliography2 min

A switch solves collisions but leaves a single broadcast domain however large the network grows - and it does not tolerate loops. The next lecture attacks both problems: VLANs for segmentation and Spanning Tree for redundancy without loops.

In laboratory 2 you will clear a real CAM table, fill it while watching it frame by frame, and compare, on the same topology, a switch with a hub.

• IEEE 802.3 - the frame format and the CSMA/CD mechanism
• IEEE 802.1D - the operation of a transparent bridge
• The public IEEE OUI registry, for identifying the manufacturer from a MAC address
• Andrew S. Tanenbaum, Computer Networks, chapter 4 - the medium access sublayer
• Charles Spurgeon, Ethernet: The Definitive Guide