ESE 4070-5070 Fall 2025

Class 2 part 2
Andy Smith
andsmi@[Link]
The Link Layer
The four layer Internet model
Source End-Host Dest End-Host

Application Application

Transport Router Router Transport

Network Network Network Network

Link Link Link Link

MAC addresses
▪ 32-bit IPv4 address and/or 128-bit IPv6 address:
• network-layer address for interface
• used for layer 3 (network layer) forwarding
• e.g.: [Link] or 2001:123:456::1
▪ MAC (or LAN or physical or Ethernet) address:
• function: used “locally” to get frame from one interface to another
physically-connected interface (same subnet, in IP-addressing sense)
• 48-bit MAC address (for most LANs) burned in NIC ROM, also
sometimes software settable
• e.g.: 1A-2F-BB-76-09-AD
hexadecimal (base 16) notation
(each “numeral” represents 4 bits)
 MAC addresses
Each interface on LAN:
▪ has globally unique 48-bit MAC address
▪ has a locally or globally unique 32-bit IPv4 and/or 128 bit IPv6 address

[Link]
1A-2F-BB-76-09-AD

LAN
(wired or wireless)
[Link]/24
71-65-F7-2B-08-53 58-23-D7-FA-20-B0
[Link] [Link]

0C-C4-11-6F-E3-98
[Link]
MAC addresses
▪ MAC address allocation administered by IEEE
▪ manufacturer buys portion of MAC address space (to
assure uniqueness)
▪ analogy:
• MAC address: like Social Security Number
• IP address: like postal address
▪ MAC flat address: portability
• can move interface from one LAN to another
• Cannot aggregate MAC addresses
ARP: address resolution protocol
Question: how to determine interface’s MAC address, knowing its IPv4
address?
ARP table: each IPv4 node (host,
ARP
router) on LAN has table
[Link]
ARP
1A-2F-BB-76-09-AD • IP/MAC address mappings for
ARP some LAN nodes:
LAN < IP address; MAC address; TTL>
71-65-F7-2B-08-53
[Link]
58-23-D7-FA-20-B0
[Link] • TTL (Time To Live): time after
ARP 0C-C4-11-6F-E3-98 which address mapping will be
[Link]
forgotten (typically 20 min)
ARP protocol in action
example: A wants to send datagram to B
• B’s MAC address not in A’s ARP table, so A uses ARP to find B’s MAC address

A broadcasts ARP query, containing B's IP addr

Ethernet frame (sent to FF-FF-FF-FF-FF-FF)
1 • destination MAC address = FF-FF-FF-FF-FF-FF
• all nodes on LAN receive ARP query C Source MAC: 71-65-F7-2B-08-53
Source IP: [Link]
ARP table in A Target IP address: [Link]
…
IP addr MAC TTL
TTL
addr A B
1

71-65-F7-2B-08-53 58-23-D7-FA-20-B0
[Link] [Link]

D
ARP protocol in action
Example: A wants to send datagram to B
• B’s MAC address not in A’s ARP table, so A uses ARP to find B’s MAC address

ARP message into Ethernet frame

(sent to 71-65-F7-2B-08-53)
C Target IP address: [Link]
Target MAC address:
ARP table in A 58-23-D7-FA-20-B0
…
IP addr MAC TTL
TTL
addr A B
2
71-65-F7-2B-08-53 58-23-D7-FA-20-B0
[Link] [Link]

2 B replies to A with ARP

response, giving its MAC address
D
 ARP protocol in action
Example: A wants to send datagram to B
• B’s MAC address not in A’s ARP table, so A uses ARP to find B’s MAC address

C
ARP table in A
IP addr MAC addr TTL
[Link] 58-23-D7-FA-20-B0 500
A B

71-65-F7-2B-08-53 58-23-D7-FA-20-B0
[Link] [Link]

3 A receives B’s reply, adds B entry

into its local ARP table
D
 IPv6 Neighbor Discovery
IPv6 does not use ARP.
• NDP (neighbor discovery protocol)
dynamically finds IPv6 hosts on an L2
network (like ARP)
• Leverages ICMPv6
• Automatically discovers Routers on a
network
• Sets the stage for IPv6
autoconfiguration
• Allows IPv6 routers to advertise their
MTU
• Can detect half-link failures
• Uses link-local addressing semantics
Routing to another subnet: addressing
walkthrough: sending a datagram from A to B via R
▪ focus on addressing – at IP (datagram) and MAC layer (frame) levels
▪ assume that:
• A knows B’s IP address
• A knows IP address of first hop router, R (how?)
• A knows R’s MAC address (how?)

A B
R
[Link]
74-29-9C-E8-FF-55 [Link]
49-BD-D2-C7-56-2A
[Link]
1A-23-F9-CD-06-9B
[Link] [Link]
CC-49-DE-D0-AB-7D E6-E9-00-17-BB-4B [Link]
88-B2-2F-54-1A-0F
Routing to another subnet: addressing
▪ A creates IP datagram with IP source A, destination B
▪ A creates link-layer frame containing A-to-B IP datagram
• R's MAC address is frame’s destination
MAC src: 74-29-9C-E8-FF-55
MAC dest: E6-E9-00-17-BB-4B
IP src: [Link]
IP dest: [Link]

IP
Eth
Phy

A B
R
[Link]
74-29-9C-E8-FF-55 [Link]
49-BD-D2-C7-56-2A
[Link]
1A-23-F9-CD-06-9B
[Link] [Link]
CC-49-DE-D0-AB-7D E6-E9-00-17-BB-4B [Link]
88-B2-2F-54-1A-0F
Routing to another subnet: addressing
▪ frame sent from A to R
▪ frame received at R, datagram removed, passed up to IP
IP src: [Link]
IP dest: [Link]

MAC src: 74-29-9C-E8-FF-55

MAC dest: E6-E9-00-17-BB-4B
IP src: [Link]
IP dest: [Link]

IP IP
Eth Eth
Phy Phy

A B
R
[Link]
74-29-9C-E8-FF-55 [Link]
49-BD-D2-C7-56-2A
[Link]
1A-23-F9-CD-06-9B
[Link] [Link]
CC-49-DE-D0-AB-7D E6-E9-00-17-BB-4B [Link]
88-B2-2F-54-1A-0F
Routing to another subnet: addressing
▪ R determines outgoing interface, passes datagram with IP source A, destination B
to link layer
▪ R creates link-layer frame containing A-to-B IP datagram. Frame destination
address: B's MAC address MAC src: 1A-23-F9-CD-06-9B
MAC dest: 49-BD-D2-C7-56-2A
IP src: [Link]
IP dest: [Link]

IP
Eth
Phy

A B
R
[Link]
74-29-9C-E8-FF-55 [Link]
49-BD-D2-C7-56-2A
[Link]
1A-23-F9-CD-06-9B
[Link] [Link]
CC-49-DE-D0-AB-7D E6-E9-00-17-BB-4B [Link]
88-B2-2F-54-1A-0F
Routing to another subnet: addressing
▪ R determines outgoing interface, passes datagram with IP source A, destination B
to link layer
▪ R creates link-layer frame containing A-to-B IP datagram. Frame destination
address: B's MAC address MAC src: 1A-23-F9-CD-06-9B
MAC dest: 49-BD-D2-C7-56-2A
▪ transmits link-layer frame IP src: [Link]
IP dest: [Link]
IP
IP Eth
Eth Phy
Phy

A B
R
[Link]
74-29-9C-E8-FF-55 [Link]
49-BD-D2-C7-56-2A
[Link]
1A-23-F9-CD-06-9B
[Link] [Link]
CC-49-DE-D0-AB-7D E6-E9-00-17-BB-4B [Link]
88-B2-2F-54-1A-0F
Routing to another subnet: addressing
▪ B receives frame, extracts IP datagram destination B
▪ B passes datagram up protocol stack to IP

IP src: [Link]
IP dest: [Link]

IP
IP Eth
Eth Phy
Phy

A B
R
[Link]
74-29-9C-E8-FF-55 [Link]
49-BD-D2-C7-56-2A
[Link]
1A-23-F9-CD-06-9B
[Link] [Link]
CC-49-DE-D0-AB-7D E6-E9-00-17-BB-4B [Link]
88-B2-2F-54-1A-0F
Ethernet
“dominant” wired LAN technology:
▪ first widely used LAN technology
▪ simpler, cheap
▪ kept up with speed race: 10 Mbps – 800 Gbps
▪ single chip, multiple speeds (e.g., Broadcom BCM5761)
Bob Metcalfe: Ethernet co-inventor,
2022 ACM Turing Award recipient
Metcalfe’s Ethernet
sketch
Ethernet: physical topology
▪ bus: popular through mid 90s
• all nodes in same collision domain (can collide with each other)
▪ switched: prevails today
• active link-layer 2 switch in center
• each “spoke” runs a (separate) Ethernet protocol (nodes do not collide with
each other)

bus: coaxial cable switched

Ethernet frame structure
sending interface encapsulates IP datagram (or other network layer
protocol packet) in Ethernet frame
type
dest. source data (payload) CRC
preamble address address

preamble:
▪ used to synchronize receiver, sender clock rates
▪ 7 bytes of 10101010 followed by one byte of 10101011
Ethernet frame structure (more)
type
dest. source data (payload) CRC
preamble address address

▪ addresses: 6 byte source, destination MAC addresses

• if adapter receives frame with matching destination address, or with broadcast
address (e.g., ARP packet), it passes data in frame to network layer protocol
• otherwise, adapter discards frame
▪ type: indicates higher layer protocol
• mostly IP but others possible, e.g., Novell IPX, AppleTalk
• used to demultiplex up at receiver
▪ CRC: cyclic redundancy check at receiver
• error detected: frame is dropped
Ethernet: unreliable, connectionless
▪connectionless: no handshaking between sending and
receiving NICs
▪unreliable: receiving NIC doesn’t send ACKs or NAKs to
sending NIC
• data in dropped frames recovered only if initial sender uses
higher layer rdt (e.g., TCP), otherwise dropped data lost
▪Ethernet’s MAC protocol: unslotted CSMA/CD with binary
backoff
 802.3 Ethernet standards: link & physical layers
▪ many different Ethernet standards
• common MAC protocol and frame format
• different speeds: 2 Mbps, ... 100 Mbps, 1Gbps, 10 Gbps, 40 Gbps, 80 Gbps
• different physical layer media: fiber, cable

MAC protocol
application
and frame format
transport
network 100BASE-TX 100BASE-T2 100BASE-FX
link 100BASE-T4 100BASE-SX 100BASE-BX
physical

copper (twister pair) physical layer fiber physical layer

Ethernet switch
▪ Switch is a link-layer device: takes an active role
• store, forward Ethernet (or other type of) frames
• examine incoming frame’s MAC address, selectively forward frame
to one-or-more outgoing links when frame is to be forwarded on
segment, uses CSMA/CD to access segment
▪ transparent: hosts unaware of presence of switches
▪ plug-and-play, self-learning
• switches do not need to be configured
Switch: multiple simultaneous transmissions
▪ hosts have dedicated, direct
connection to switch A
▪ switches buffer packets C’ B
▪ Ethernet protocol used on each 1 2
incoming link, so: 6
3
• no collisions; full duplex 5 4
• each link is its own collision
domain B’ C
A’
▪ switching: A-to-A’ and B-to-B’ can transmit
simultaneously, without collisions switch with six
interfaces (1,2,3,4,5,6)
Switch: multiple simultaneous transmissions
▪ hosts have dedicated, direct
connection to switch A
▪ switches buffer packets C’ B
▪ Ethernet protocol used on each 1 2
incoming link, so: 6
3
• no collisions; full duplex 5 4
• each link is its own collision
domain B’ C
A’
▪ switching: A-to-A’ and B-to-B’ can transmit
simultaneously, without collisions switch with six
• but A-to-A’ and C to A’ can not happen interfaces (1,2,3,4,5,6)
simultaneously
Switch forwarding table
Q: how does switch know A’ reachable via
interface 4, B’ reachable via interface 5? A
C’ B
A: each switch has a switch table, each
entry: 1 2
6
▪ (MAC address of host, interface to reach 3
5 4
host, time stamp)
▪ looks like a routing table! B’ C
A’
Q: how are entries created, maintained
in switch table?
▪ something like a routing protocol?
Switch: self-learning Source: A

▪ switch learns which hosts Dest: A’

A A’
can be reached through A
which interfaces C’ B
• when frame received, switch 1 2
“learns” location of sender: 6
3
incoming LAN segment 5 4

• records sender/location pair B’ C

A’
in switch table
Switch table
MAC addr interface TTL (initially empty)
A 1 60
Switch: frame filtering/forwarding
when frame received at switch:
1. record incoming link, MAC address of sending host
2. index switch table using MAC destination address
3. if entry found for destination
then {
if destination on segment from which frame arrived
then drop frame
else forward frame on interface indicated by entry
}
else flood /* forward on all interfaces except arriving interface */
Self-learning, forwarding: example Source: A
Dest: A’

▪ frame destination, A’, A A’

location unknown: flood A
C’ B
▪ destination A location
1
known: selectively send 6A A’
2
3
on just one link 5 4

B’ C
A’ A A’

MAC addr interface TTL

A 1 60 switch table
A’ 4 60 (initially empty)
Interconnecting switches
self-learning switches can be connected together:

S4

S1
S3
A S2
F
D I
B C
G H
E

Q: sending from A to G - how does S1 know to forward frame destined

to G via S4 and S3?
▪ A: self learning! (works exactly the same as in single-switch case!)
Self-learning multi-switch example
Suppose C sends frame to I, I responds to C
S4

S1
S3
A S2
F
D I
B C
G H
E

Q: show switch tables and packet forwarding in S1, S2, S3, S4

Switches vs. routers application
transport
both are store-and-forward: datagram network
frame link
▪ routers: network-layer devices (examine physical link frame
network-layer headers) physical

▪ switches: link-layer devices (examine switch

link-layer headers) network datagram
link
both have forwarding tables: physical
frame

▪ routers: compute tables using routing application

algorithms, IP addresses transport
▪ switches: learn forwarding table using network
link
flooding, learning, MAC addresses
physical
The four layer Internet model
Source End-Host Dest End-Host

Application Application

Transport Router Switch Transport

Network Network IPv4/IPv6 Network Network

Eth MAC Eth MAC
Link Link Link Link
 Loops in Layer2 Ethernet
S4

S1
S2 S3
A B

Loops in Layer2 networks can be VERY BAD:

▪ Layer2 devices, whether bridges, hubs or switches have no way of
knowing if they’ve seen this frame before
▪ If A attempts to ARP for B’s IPv4 address and sends an ARP BROADCAST,
that ethernet frame will loop indefinitely in the above topology
▪ This is known as a ‘broadcast storm’ and can be a real problem
Spanning Tree Protocol

▪ Invented by Radia Perlman in 1985 while at Digital

Equipment Corporation
▪ Automatically establishes a loop-free Layer 2
ethernet topology by electing a ‘root’ node and
assigning ports radiating from the root as
‘designated’ or blocked’
▪ Floods the network with “BPDU” frames (bridge
protocol data units)
Spanning Tree Example
S4

S1 Physical Topology
S2 S3
A B

S4

S1 Spanning Tree
S2 S3 Logical Topology
A B Loop Free

STP Root (elected) Blocked paths

Virtual LANs (VLANs): motivation
Q: what happens as LAN sizes scale, users change point of attachment?
single broadcast domain:
▪ scaling: all layer-2 broadcast traffic
(ARP, DHCP, unknown MAC) must
cross entire LAN
Computer ▪ efficiency, security, privacy issues
Science EE
Virtual LANs (VLANs): motivation
Q: what happens as LAN sizes scale, users change point of attachment?
single broadcast domain:
▪ scaling: all layer-2 broadcast traffic
(ARP, DHCP, unknown MAC) must
cross entire LAN
Computer ▪ efficiency, security, privacy, efficiency
Science EE issues
administrative issues:
▪ CS user moves office to EE - physically
attached to EE switch, but wants to
remain logically attached to CS
switch
Port-based VLANs port-based VLAN: switch ports grouped (by
switch management software) so that
single physical switch ……
Virtual Local Area
Network (VLAN) 7 9 15
1
2 8 10 16
switch(es) supporting
… …
VLAN capabilities can
EE (VLAN ports 1-8) CS (VLAN ports 9-15)
be configured to define
multiple virtual LANS … operates as multiple virtual switches
over single physical
LAN infrastructure.
1 7 9 15

2 8 10 16

… …
EE (VLAN ports 1-8) CS (VLAN ports 9-15)

Link Layer: 6-40

Port-based VLANs
▪ traffic isolation: frames to/from ports
1-8 can only reach ports 1-8
• can also define VLAN based on MAC
addresses of endpoints, rather than
switch port
▪ dynamic membership: ports can be
dynamically assigned among VLANs 1 7 9 15

2 8 10 16

▪ forwarding between VLANS: done via … …

routing (just as with separate EE (VLAN ports 1-8) CS (VLAN ports 9-15)

switches)
• in practice vendors sell combined
switches plus routers
VLANS spanning multiple switches

1 7 9 15 1 3 5 7
2 8 10 16 2 4 6 8

… … …
EE (VLAN ports 1-8) CS (VLAN ports 9-15) Ports 2,3,5 belong to EE VLAN
Ports 4,6,7,8 belong to CS VLAN

trunk port: carries frames between VLANS defined over multiple

physical switches
▪ frames forwarded within VLAN between switches can’t be vanilla 802.1
frames (must carry VLAN ID info)
▪ 802.1q protocol adds/removed additional header fields for frames
forwarded between trunk ports
802.1Q VLAN frame format
type
dest. source data (payload) CRC
preamble address address 802.1 Ethernet frame

type
dest. source data (payload) CRC
preamble address address 802.1Q frame

2-byte Tag Protocol Identifier Recomputed

(value: 81-00) Tag Control Information CRC
(12 bit VLAN ID field, 3 bit priority field like IP
TOS)
Assignment

• Will be posted to Canvas tonight

• Includes getting your lab environment setup – detailed instructions in the assignment

• Have fun!