Data Link Layer

1. What is the Data Link Layer?

• Layer 2 of the OSI model

• Bridge between Physical and Network layers

• Converts packets (from Layer 3) into frames (for Layer 1)

• Uses physical (MAC) addresses, NOT logical (IP) addresses

• Provides error detection (not correction)

• Handles flow control and message delivery on LANs

2. Core Functions

1. Framing: Converts packets into frames

2. Physical Addressing: Uses MAC addresses for device identification

3. Error Detection: Uses CRC checksums to detect errors

4. Flow Control: Manages data transmission rate

5. Media Access Control: Determines how devices share network bandwidth

3. Two Sublayers (Critical for Exam!)

MAC Sublayer (Media Access Control) - IEEE 802.3:

• Bottom sublayer of Layer 2

• Controls how devices transmit on the network

• Defines hardware (MAC) addressing

• Handles physical topologies

• Provides error notification (not correction)

• Manages signal path

• Ensures correct frame delivery

• First come/first served bandwidth sharing

LLC Sublayer (Logical Link Control) - IEEE 802.2:

• Upper sublayer of Layer 2

• Error checking and packet synchronization

• Locates Network Layer protocols

• Encapsulates packets from Layer 3

• Tells Data Link Layer how to process received frames

• Recalculates checksums at receiving end

• Manages acknowledgements

Layer 2 Responsibilities

✓ Serves Network Layer (Layer 3) - provides services to layer above ✓ Error Handling - detects errors, doesn't correct them ✓ Flow Control - manages transmission rate ✓ Physical Addressing - uses MAC addresses (48-bit) ✓ Frame Creation - adds header with source/destination MAC, CRC ✓ LAN Communication - ensures messages reach correct device on local network ✓ Encapsulation/De-encapsulation - adds/removes Layer 2 headers

Data Flow Process

SENDING (Encapsulation):

Layer 3 Packet

↓

Layer 2 adds header (MAC addresses, CRC)

↓

Layer 2 Frame created

↓

Sent to Layer 1 for transmission

RECEIVING (De-encapsulation):

Layer 1 receives signals

↓

Layer 2 receives frame

↓

LLC recalculates checksum

↓

If valid: Send ACK, pass to Layer 3

If invalid: Request retransmission

Frame Structure

[Header | Payload | Trailer]

↓ ↓ ↓

MAC Network CRC

addresses Layer (error

(src/dst) packet checking)

Critical Distinctions

Sublayer Definitions

Physical Addressing:

• Uses MAC addresses (e.g., 00:1A:2B:3C:4D:5E)

• Hardware address burned into NIC (Network Interface Card)

• 48 bits = 6 bytes = 12 hexadecimal digits

• First 3 bytes = OUI (Organizationally Unique Identifier) - vendor ID

• Last 3 bytes = Device-specific identifier

Error Detection Process:

1. Sender: Calculates CRC from frame data, adds to trailer

2. Transmission: Frame sent across network

3. Receiver: Recalculates CRC from received data

4. Comparison: If calculated CRC = received CRC → Valid frame (send ACK)

5. If mismatch: Frame corrupted → Request retransmission

Media Access Control:

• First come/first served: All devices share bandwidth

• Determines when a device can transmit

• Prevents/detects collisions

• No priority system (everyone waits their turn)

IEEE Standards (CRITICAL!)

Data Link Layer Protocols

Key Numbers

PPP (Point-to-Point Protocol):

• Used for WAN connections

• Supports authentication (PAP, CHAP)

• Provides error detection

• Common for dial-up, DSL

HDLC (High-Level Data Link Control):

• Cisco's default WAN protocol

• Bit-oriented protocol

• Cisco version is proprietary

• Synchronous serial connections

Ethernet (802.3):

• Most common LAN technology

• Uses CSMA/CD (Carrier Sense Multiple Access/Collision Detection)

• Supports various speeds (10 Mbps to 100 Gbps)

❌ WRONG: "Routers use MAC addresses to route packets"

✅ CORRECT: "Routers use IP addresses (Layer 3); switches use MAC addresses (Layer 2)"

❌ WRONG: "MAC addresses are assigned by network administrator"

✅ CORRECT: "MAC addresses are burned into hardware by manufacturer"

❌ WRONG: "Data Link Layer corrects errors"

✅ CORRECT: "Data Link Layer DETECTS errors; higher layers handle correction"

❌ WRONG: "LLC corrects corrupted frames"

✅ CORRECT: "LLC detects corruption and requests retransmission"

❌ WRONG: "LLC handles physical transmission"

✅ CORRECT: "MAC handles physical transmission; LLC handles error checking and protocol identification"

❌ WRONG: "802.3 is LLC standard"

✅ CORRECT: "802.2 = LLC; 802.3 = MAC (Ethernet)"

❌ WRONG: "Switches operate at Layer 3"

✅ CORRECT: "Switches operate at Layer 2 (some multilayer switches do both Layer 2 and 3)"

❌ WRONG: "Hubs are Layer 2 devices"

✅ CORRECT: "Hubs are Layer 1 devices; switches are Layer 2 devices"

❌ WRONG: "Data Link Layer processes packets"

✅ CORRECT: "Data Link Layer creates FRAMES from packets"

❌ WRONG: "Frames are used at Layer 3"

✅ CORRECT: "Packets = Layer 3; Frames = Layer 2; Bits = Layer 1"

❌ WRONG: "Layer 2 cares about IP addresses"

✅ CORRECT: "Layer 2 only cares about MAC addresses (physical addressing)"

❌ WRONG: "Routers care about actual physical location of devices"

✅ CORRECT: "Data Link Layer cares about physical location on LAN; routers care about logical network addresses"

❌ WRONG: "Data Link Layer handles end-to-end communication"

✅ CORRECT: "Data Link Layer handles node-to-node (hop-by-hop) communication; Network Layer handles end-to-end"

❌ WRONG: "I need to know all details of Frame Relay and ATM"

✅ CORRECT: "Know they exist and are legacy; focus on Ethernet, PPP, HDLC for CCNA"

LAYER 3 (Network Layer):

- Creates packet with:

- Source IP: 192.168.1.10

- Destination IP: 192.168.1.20

- Data payload

↓ Pass to Layer 2

LAYER 2 (Data Link Layer):

- Receives packet from Layer 3

- MAC sublayer adds header:

- Source MAC: AA:BB:CC:DD:EE:01

- Destination MAC: AA:BB:CC:DD:EE:02

- Calculates CRC, adds trailer

- Frame created: [Header | Packet | CRC]

↓ Pass to Layer 1

LAYER 1 (Physical Layer):

- Converts frame to electrical signals

- Transmits on cable

SENDER (PC1):

1. Creates frame with data

2. Calculates CRC: 0xA3F2

3. Adds CRC to frame trailer

4. Sends: [Header | Data | CRC: 0xA3F2]

TRANSMISSION:

Frame travels across network...

RECEIVER (PC2):

1. Receives: [Header | Data | CRC: 0xA3F2]

2. Extracts data portion

3. Recalculates CRC: 0xA3F2

4. Compares: Received CRC (0xA3F2) = Calculated CRC (0xA3F2)

5. Match! ✓ Send ACK to sender

6. Pass packet up to Layer 3

CORRUPTED SCENARIO:

Receiver calculates CRC: 0xB4E1

Compares: 0xA3F2 ≠ 0xB4E1

Mismatch! ✗ Discard frame, request retransmission

SWITCH receives frame on Port 1:

- Reads destination MAC: BB:BB:BB:BB:BB:BB

- Checks MAC address table:

Port | MAC Address

-----|------------------

1 | AA:AA:AA:AA:AA:AA

2 | BB:BB:BB:BB:BB:BB

3 | CC:CC:CC:CC:CC:CC

- Finds MAC on Port 2

- Forwards frame ONLY to Port 2

- Does NOT forward to Ports 3, 4, 5...

Note: Switch ONLY looks at Layer 2 (MAC) addresses!

PC1 → Switch1 → Router → Switch2 → PC2

Hop 1 (PC1 to Switch1):

- Source MAC: PC1's MAC

- Dest MAC: Router's MAC (port facing PC1)

- Source IP: PC1's IP

- Dest IP: PC2's IP

(MAC changes, IP stays same)

Hop 2 (Router to Switch2):

- Source MAC: Router's MAC (port facing Switch2)

- Dest MAC: PC2's MAC

- Source IP: PC1's IP

- Dest IP: PC2's IP

(MAC changes AGAIN, IP still stays same)

KEY POINT: MAC addresses change at each hop (Layer 2)

IP addresses remain constant (Layer 3 end-to-end)

FRAME ARRIVES:

[MAC Header | LLC Header | Network Layer Data | Trailer]

LLC Header contains:

- DSAP (Destination Service Access Point)

- SSAP (Source Service Access Point)

- Control information

LLC reads header:

"This frame contains an IPv4 packet"

↓

Pass to IPv4 processing

OR

"This frame contains an IPv6 packet"

↓

Pass to IPv6 processing

OR

"This frame contains an ARP packet"

↓

Pass to ARP processing

LLC's job: Identify what type of Layer 3 protocol is encapsulated

SENDER (Fast Server):

- Can send 1000 frames/second

RECEIVER (Slow PC):

- Can only process 100 frames/second

WITHOUT FLOW CONTROL:

- Receiver overwhelmed

- Frames dropped

- Data lost

WITH FLOW CONTROL:

- Receiver signals sender: "Slow down!"

- Sender reduces transmission rate

- All frames successfully received

LAYER 1 CHECK:

✓ Cable plugged in

✓ Link lights on

Layer 1 is working!

LAYER 2 CHECK:

Command: show mac address-table

Result: No MAC address for this device

Problem: Layer 2 issue!

Possible causes:

- MAC address filtering enabled

- Port security violation

- VLAN mismatch

- Spanning tree blocking

Layer 2 is the problem layer!

MAC Address: 00:1A:2B:3C:4D:5E

Breaking it down:

00:1A:2B = OUI (Organizationally Unique Identifier)

Vendor: This identifies manufacturer

3C:4D:5E = Device-specific identifier

Unique to this particular device

Example Vendors:

00:1A:2B = Might be Cisco

00:50:56 = VMware

08:00:27 = Oracle VirtualBox

Total: 48 bits = 6 bytes = 12 hex digits

Layer 2 of the OSI model; responsible for node-to-node communication, physical addressing, error detection, and frame creation

Layer 2

Packets

Frames

Physical addressing (MAC addresses)

No, Layer 2 only cares about physical (MAC) addresses

Frame

Network Layer (Layer 3)

Physical Layer (Layer 1)

No, it only DETECTS errors; it doesn't correct them

MAC (Media Access Control) and LLC (Logical Link Control)

Media Access Control

Logical Link Control

IEEE 802.3

IEEE 802.2

MAC (it's the lower sublayer)

LLC (it's the upper sublayer)

How packets are transmitted, hardware addressing, error notification, signal path, physical topologies, frame delivery

Error checking, packet synchronization, locating network layer protocols, encapsulation, telling Data Link how to process frames

MAC sublayer

LLC sublayer

A 48-bit physical hardware address unique to each network device

48 bits (6 bytes)

12 hexadecimal digits in 6 pairs (e.g., 00:1A:2B:3C:4D:5E)

Organizationally Unique Identifier

3 bytes (first half of MAC address)

The manufacturer/vendor of the network device

3 bytes (last half of MAC address)

The manufacturer (burned into the NIC at factory)

Physically no (burned in), but can be spoofed in software

In the Network Interface Card (NIC) ROM

Yes, each MAC address should be globally unique

Physical address

The Protocol Data Unit (PDU) at Layer 2; a packet with Layer 2 header and trailer added

Header, Payload (data), and Trailer

Source and destination MAC addresses, control information

CRC (Cyclic Redundancy Check) for error detection

The process of adding a Layer 2 header and trailer to a Layer 3 packet to create a frame

The process of removing the Layer 2 header and trailer from a frame to extract the packet

A header (containing MAC addresses) and trailer (containing CRC)

The Layer 2 header/trailer are removed (de-encapsulated), and the packet is passed to Layer 3

Cyclic Redundancy Check

To detect errors in frame transmission

n the trailer (end of frame)

Sender calculates CRC, adds to frame; receiver recalculates CRC and compares with received value

Frame is valid; receiver sends acknowledgement (ACK) and passes data to Layer 3

Frame is corrupted; receiver discards it and requests retransmission

No, it only DETECTS errors; correction is handled by higher layers

LLC (Logical Link Control) sublayer

A signal sent by the receiver confirming successful frame receipt

The transmitting device will retransmit the frame

A mechanism to manage the rate of data transmission between sender and receiver

To prevent a fast sender from overwhelming a slow receiver

Layer 2 (Data Link Layer) - also Layer 4 has flow control

Receiver may be overwhelmed, causing frame loss and data corruption

Switch

MAC addresses

MAC address table (CAM table)

Layer 2 (Data Link Layer)

Layer 1 (Physical Layer) - NOT Layer 2!

Layer 3 (Network Layer)

A switch that can operate at both Layer 2 and Layer 3

No (unless it's a multilayer switch); Layer 2 switches only use MAC addresses

A Layer 2 device that connects network segments (predecessor to switches)

A hardware component that connects a device to a network; contains the MAC address

Ethernet (802.3), PPP (Point-to-Point Protocol), HDLC

Frame Relay, ATM (Asynchronous Transfer Mode), FDDI

Point-to-Point Protocol

WAN point-to-point connections (dial-up, DSL)

High-Level Data Link Control

HDLC (Cisco proprietary version)

Fiber Distributed Data Interface

Asynchronous Transfer Mode

No, it's a legacy technology (mostly replaced by MPLS, VPNs)

Ethernet (IEEE 802.3)

Layer 2 uses physical (MAC) addresses; Layer 3 uses logical (IP) addresses

Layer 2 (Physical Layer is working if link lights are on)

VLAN mismatch, port security, ACL, spanning tree blocking, Layer 3 issue

Use command: show mac address-table

It floods the frame out all ports except the port it was received on

Process where switches learn which MAC addresses are on which ports by examining source MAC addresses

Typically 300 seconds (5 minutes) - aging time

A frame sent to all devices (destination MAC: FF:FF:FF:FF:FF:FF)

A frame sent to a single specific device

A frame sent to a group of devices

Detection identifies errors; correction fixes them. Layer 2 only detects, doesn't correct.

MAC = physical/hardware (Layer 2); IP = logical/software (Layer 3)

Switch = Layer 2 (uses MAC); Router = Layer 3 (uses IP)

Frame = Layer 2 PDU; Packet = Layer 3 PDU

MAC = physical transmission, addressing; LLC = error checking, protocol ID

Using hardware MAC addresses (as opposed to logical IP addresses)

1. "What layer does a switch operate at?" → Layer 2

2. "What address does Layer 2 use?" → MAC (physical) address

3. "What are the two sublayers of Layer 2?" → MAC and LLC

4. "Does Layer 2 correct errors?" → No, only detects

5. "What is the Layer 2 PDU called?" → Frame

6. "Which IEEE standard defines Ethernet?" → 802.3

7. "Which sublayer handles error checking?" → LLC

8. "How many bits is a MAC address?" → 48 bits

• "Switch" → Think Layer 2, MAC addresses

• "MAC address" → Physical, Layer 2, doesn't change by admin

• "Frame" → Layer 2 PDU

• "CRC" → Error detection, not correction

• "802.3" → MAC/Ethernet

• "802.2" → LLC

• "Error correction" → NOT Layer 2 (higher layers)

• "End-to-end" → Layer 3, not Layer 2

LAYER 2 QUICK REF:

- Switch = L2 (MAC addresses)

- Frame = L2 PDU

- MAC = 48 bits (physical address)

- 802.2 = LLC (error check)

- 802.3 = MAC (Ethernet)

- Detect errors, don't correct

- MAC sublayer = bottom

- LLC sublayer = top

• Questions saying switches use IP addresses (wrong!)

• Questions saying Layer 2 corrects errors (only detects!)

• Confusing hub (L1) with switch (L2)

• Thinking MAC addresses are assigned by admin (they're burned in)

• Mixing up 802.2 and 802.3

• If question mentions MAC address → Answer is Layer 2

• If question mentions IP address → Answer is Layer 3

• If question says "error correction" → NOT Layer 2

• If device is "switch" → Layer 2

• If device is "router" → Layer 3