What you will learn
By the end of this module, you should be able to describe how Layer 2 organizes bits into frames, explain the purpose of MAC addresses, distinguish the LLC and MAC sublayers, and understand how local delivery works across a LAN.
- Explain the purpose and scope of the Data Link Layer.
- Describe framing, addressing, error detection, and media access.
- Distinguish the LLC and MAC sublayers in the IEEE 802 model.
- Identify the purpose and structure of a 48-bit Ethernet MAC address.
- Explain unicast, multicast, and broadcast delivery at Layer 2.
- Understand how switches use MAC addresses to forward Ethernet frames.
1. What is the Data Link Layer?
The Data Link Layer (Layer 2) provides node-to-node delivery over a single Layer 2 link or network segment. It takes the bit stream provided by Layer 1 and organizes it into structured units called frames. It defines how devices identify one another on the local link, how access to a shared medium is coordinated, and how certain transmission errors are detected.
Layer 2 is concerned with local delivery. Ethernet switches use destination MAC addresses to decide where to forward frames. Routers operate at Layer 3 and use IP addresses and routing information to move packets between different IP networks.
Encapsulates Layer 3 packets into frames with defined boundaries and fields.
Uses link-layer addresses, such as Ethernet MAC addresses, to identify interfaces on a LAN.
Uses mechanisms such as the Ethernet FCS to detect corrupted frames.
Defines how devices share and access the transmission medium.
Layer 2 does not replace Layer 3
A host sending data to a destination on another IP network still sends an Ethernet frame to its local default gateway. The IP packet retains the remote destination IP address, but the Ethernet destination MAC address identifies the next hop on the local link. At each routed hop, the Layer 2 frame is removed and a new frame is built for the next link.
2. Encapsulation: packet inside a frame
Ethernet adds a Layer 2 header and trailer around the payload it receives from the Network Layer. This is called encapsulation. The receiving interface checks the frame and passes its payload up the protocol stack when appropriate.
The destination and source MAC addresses identify the receiving and transmitting interfaces on the local Ethernet segment. The Type field commonly identifies the payload protocol, such as IPv4 (0x0800) or IPv6 (0x86DD). The Frame Check Sequence (FCS) contains a CRC used to detect corruption. It does not correct the corrupted frame; a frame that fails the check is discarded.
Ethernet frame size
A traditional Ethernet frame has a 64-byte minimum and a 1518-byte maximum when counted from destination MAC through FCS, without an 802.1Q tag. A VLAN-tagged frame adds four bytes. The preamble and start-frame delimiter are not included in those frame-size values. Jumbo frames are supported by some devices and networks, but they are not a universal Ethernet requirement.
3. The LLC and MAC sublayers
The IEEE 802 model divides the Data Link Layer into two sublayers. This split separates the interface to Layer 3 protocols from the functions needed to access the physical medium.
The upper sublayer. Provides an interface to the Network Layer and identifies which Layer 3 protocol is being carried in some link-layer technologies.
The lower sublayer. Handles link-layer addressing and media-access rules, and defines how frames are placed onto the medium.
MAC addresses
A typical Ethernet MAC address is 48 bits (6 bytes), usually written as six hexadecimal octets, for example 00:1A:2B:3C:4D:5E. The first 24 bits are commonly the Organizationally Unique Identifier (OUI), assigned to an organization, and the remaining bits identify an interface within that allocation. Modern address allocation includes additional details, but this is the standard introductory model.
MAC addresses are usually described as Layer 2 addresses. They identify an interface on a local link; they are not used by routers as the end-to-end path identifier. A host can have different MAC addresses on different interfaces, and a Layer 2 frame's source/destination addresses change as a packet crosses a router onto a new link.
Unicast, multicast, and broadcast
| Delivery type | Destination | Meaning |
|---|---|---|
| Unicast | One specific interface | One sender targets one recipient. |
| Multicast | A group address | One sender targets interested members of a group. |
| Broadcast | FF:FF:FF:FF:FF:FF | Targets all devices in the local Layer 2 broadcast domain. |
Ethernet broadcast frames are flooded within the VLAN/broadcast domain by switches, but routers do not normally forward Layer 2 broadcasts between IP networks. This is one reason VLANs and IP subnets are commonly designed together.
How a switch uses Layer 2 information
A Layer 2 switch builds a MAC address table by examining the source MAC address of frames it receives. It records the source address and the port on which it arrived. When forwarding a frame, the switch looks up the destination MAC address.
- If the destination MAC is known, the switch forwards the frame out the associated port (unless that is the same port on which it arrived).
- If the destination is unknown, the switch floods the frame out the other eligible ports in the same VLAN.
- Broadcast and many multicast frames are also flooded according to the VLAN and configured forwarding behavior.
What happens when a host sends to a different subnet?
Suppose Host A wants to send an IP packet to a server on a remote network. Host A compares the destination IP with its own subnet. Because the destination is remote, it sends the frame to the MAC address of its default gateway. The frame's destination MAC is the router's local interface, while the IP packet's destination remains the remote server. The router then routes the packet and creates a new Layer 2 frame for the next link.
Layer 2 troubleshooting on IOS XE
show mac address-table show interfaces status show interfaces gigabitEthernet 0/0/1 show vlan brief
Use the MAC address table to check which port learned a host's MAC. Check interface status for link and administrative state. On a switch, confirm the port belongs to the intended VLAN. A correct MAC table entry alone does not prove that Layer 3 addressing or routing is correct.
4. Check your understanding
Answer all six questions. After submission, every option receives an explanation so you can see exactly why it is correct or incorrect.
Data Link Layer knowledge check
6 questions · one answer per question · explanations shown after submission