OSI Layer 2: Data Link Layer
Layer 2 (Data Link) Technologies
The Data Link Layer is responsible for node-to-node delivery of frames over a physical link. It provides MAC addressing, frame formatting, error detection, and media access control for direct neighbours.
The Critical Role: While the Physical Layer (1) moves raw bits, Layer 2 creates reliable frames between directly connected devices using MAC addresses and error checking.
Node A
Node B
Data Link Protocol Information
🎯 Primary Functions
- Framing: Encapsulating network data into frames
- Physical Addressing: MAC addresses for local delivery
- Error Detection: Detecting transmission errors
- Flow Control: Managing data flow between nodes
- Access Control: Coordinating access to shared media
🔧 Key Characteristics
- MAC Addresses: 48-bit hardware addresses (AA:BB:CC:DD:EE:FF)
- Frame Check Sequence: Error detection using CRC
- CSMA/CD: Collision detection in Ethernet
- Switching: Learning MAC addresses for forwarding
- VLANs: Virtual separation of network segments
🌐 Data Link Layer Protocols & Technologies
Wired LAN standard using CSMA/CD for media access control
Wireless LAN using CSMA/CA for collision avoidance
Serial link protocol for dial-up, DSL, and WAN connections
Maps IP addresses to MAC addresses for local delivery
🖼️ Ethernet Frame Structure
Understanding how data is encapsulated at Layer 2:
7 bytes SFD
1 byte Dest MAC
6 bytes Src MAC
6 bytes Type/Length
2 bytes Payload
46-1500 bytes FCS
4 bytes
Field Descriptions:
- Preamble & SFD: Synchronisation pattern (10101010...10101011)
- Destination MAC: Hardware address of receiving device
- Source MAC: Hardware address of sending device
- Type/Length: Protocol type (0x0800 = IPv4) or frame length
- Payload: Actual data from upper layer (minimum 46 bytes)
- FCS: Frame Check Sequence for error detection (CRC-32)
🏷️ MAC Address Deep Dive
MAC Address Format
│└─ Device Specific (24 bits)
└── Vendor OUI (24 bits)
48-bit address: 24-bit Organisationally Unique Identifier + 24-bit device identifier
Special MAC Addresses
- Broadcast: FF:FF:FF:FF:FF:FF — every device on the segment
- Multicast: the least significant bit of the first octet is 1, so the first octet is odd (01:00:5E:… for IPv4 multicast, 33:33:… for IPv6)
- Unicast: that same bit is 0, so the first octet is even (00:1B:44:…)
- Locally administered: the second least significant bit of the first octet is 1 — giving 02, 06, 0A, 0E, … (software-assigned rather than burnt in)
Common Vendor OUIs:
| OUI | Vendor | Example MAC |
|---|---|---|
| 00:1B:44 | Cisco Systems | 00:1B:44:AA:BB:CC |
| 00:50:56 | VMware | 00:50:56:11:22:33 |
| AC:BC:32 | Apple | AC:BC:32:44:55:66 |
🔍 Real-World Example: Ethernet Switching
Scenario: Three computers connected to an Ethernet switch
Step 1: MAC Learning
When PC-A (00:11:22:33:44:AA) sends a frame:
MAC Table: 00:11:22:33:44:AA → Port 1
Step 2: Frame Forwarding
PC-A sends frame to PC-B (00:11:22:33:44:BB):
Switch: MAC 00:11:22:33:44:BB not in table → FLOOD to all ports
Step 3: Return Path Learning
PC-B responds, switch learns its location:
MAC Table: 00:11:22:33:44:AA → Port 1, 00:11:22:33:44:BB → Port 2
Future frames between A↔B: direct port forwarding (no flooding)
🛠️ Troubleshooting Data Link Issues
🚨 Common Layer 2 Problems
- Frame errors (CRC/FCS failures)
- MAC address table overflow
- Broadcast storms
- VLAN misconfigurations
- Spanning Tree Protocol loops
- Duplex mismatches
🔧 Layer 2 Diagnostic Tools
- Switch MAC address tables
- Port statistics (errors, collisions)
- Spanning Tree Protocol status
- VLAN configuration verification
- Protocol analysers (Wireshark)
- Network topology discovery
Common Wireshark Filters for Layer 2 Analysis:
eth.dst == ff:ff:ff:ff:ff:ff # Show broadcast frames
arp # Show ARP traffic
eth.type == 0x8100 # Show VLAN tagged frames
eth.fcs_bad == 1 # Show frames with bad FCS
🎓 Teaching Analogy: Hotel Mail System
Think of the Data Link Layer like a hotel's internal mail system:
- Room Numbers (MAC Addresses): Each room has a unique number for local delivery
- Hotel Envelopes (Frames): All mail goes in hotel envelopes with room numbers
- Mail Clerk (Switch): Learns which rooms are on which floors and delivers accordingly
- Floor Directory (MAC Table): Keeps track of room locations for efficient delivery
- Delivery Receipt (Frame Check Sequence): Confirms mail arrived without damage
- Hotel Broadcast (FF:FF:FF:FF:FF:FF): Announcements delivered to every room
Just like hotel mail only works within the building, Layer 2 only works within the local network segment!
📚 Key Learning Points
- Data Link Layer provides reliable local delivery using MAC addresses
- Frames encapsulate Layer 3 packets with headers and error detection
- Switches operate at Layer 2, learning MAC addresses and forwarding frames
- Error detection (FCS/CRC) catches transmission errors but doesn't correct them
- Layer 2 creates broadcast domains - all devices that can hear each other
- MAC addresses are hardware addresses that work only within local network segments
- Ethernet is not reliable — a frame that fails its FCS is silently discarded, and it is TCP at Layer 4 that notices and retransmits
Check your understanding — Layer 2
Five questions on Layer 2 — frames, MAC addresses and switching.
-
What is the PDU at the Data Link Layer?
Layer 2 wraps the Layer 3 packet in a frame: a header with MAC addresses, the payload, and an FCS trailer.
-
How many bits long is a standard MAC address?
48 bits, usually written as six hex octets. The first 24 bits are the vendor's Organisationally Unique Identifier (OUI); the last 24 identify the individual interface.
-
A switch receives a frame for a destination MAC that is not in its table. What does it do?
This is called unknown-unicast flooding. When the destination replies, the switch learns which port it lives on and stops flooding for that address.
-
An Ethernet frame arrives with a bad Frame Check Sequence. What happens next?
The FCS only *detects* corruption, it cannot correct it. The frame is dropped, and if anything retransmits it is TCP at Layer 4 — Ethernet itself is not a reliable protocol.
-
Which device separates broadcast domains by default?
A router does not forward Layer 2 broadcasts, so each of its interfaces is its own broadcast domain. A plain switch forwards broadcasts everywhere — you need VLANs to split a switch into multiple broadcast domains.
Layer 2 (Data Link) — frequently asked questions
What is the Data Link Layer?
The Data Link Layer is Layer 2 of the OSI model. It takes the bit stream from Layer 1 and organises it into frames addressed with MAC addresses, so data can be delivered from one device to another across a single link or LAN segment. It also adds error detection through the Frame Check Sequence and controls how devices share the medium.
What is the difference between a hub, a switch and a router?
A hub (Layer 1) repeats every signal to every port. A switch (Layer 2) learns MAC addresses and forwards each frame only to the port where the destination lives. A router (Layer 3) forwards packets between different IP networks and stops broadcasts at its boundary.
Is ARP a Layer 2 or Layer 3 protocol?
Both descriptions are defensible, which is why exams often phrase it carefully. ARP frames are carried directly inside Ethernet with EtherType 0x0806 — that is Layer 2 — but their whole purpose is to resolve a Layer 3 IPv4 address into a Layer 2 MAC address. Many sources therefore call it “Layer 2.5”.
What is the maximum payload of an Ethernet frame?
1500 bytes for standard Ethernet, which is where the familiar 1500-byte MTU comes from. The minimum payload is 46 bytes — shorter payloads are padded so the total frame reaches the 64-byte minimum. Jumbo frames extend the payload to around 9000 bytes on networks configured for them.