Explain how ARP resolves IP addresses to MAC addresses
Describe Ethernet frame structure and CSMA/CD operation
Understand how switches learn and forward frames (self-learning)
Explain VLANs, trunking, and 802.1Q tagging
Trace a complete web request through all protocol layers (DHCP → ARP
→ DNS → TCP → HTTP)
Link Layer Basics Error Detection MAC Protocols ARP & Addressing Ethernet Switches VLANs Synthesis
1. Link Layer: Introduction
The link layer has the responsibility of transferring a
datagram from one node to a
physically adjacent node over a single link. It is the
lowest layer in the protocol stack that we study in detail.
Key Terminology
Nodes: hosts and routers — any device that runs a
link-layer protocol.
Links: communication channels that connect
adjacent nodes along a communication path (wired, wireless, LANs).
Frame: the layer-2 packet that encapsulates the
datagram (network-layer packet).
Transportation Analogy
Tourist = datagram
Transport segment = communication link
Transportation mode = link-layer protocol
Travel agent = routing algorithm
A trip from Princeton to Lausanne may involve limo, plane, and
train — each with different protocols.
Link Layer Context: A datagram may be transferred by
different link protocols over different links. For
example, WiFi on the first link and Ethernet on the next. Each link
protocol may provide different services — some may
offer reliable delivery, others may not.
2. Link Layer Services
Framing, Link Access
Encapsulate datagram into frame, add header/trailer. Channel access if
shared medium. MAC addresses in frame headers identify source and
destination.
Reliable Delivery
Between adjacent nodes. Seldom used on low bit-error links (fiber,
twisted pair). Used on high-error wireless links. End-to-end
reliability (TCP) is already present.
Flow Control
Pacing between adjacent sending and receiving nodes to prevent
overwhelming the receiver.
Error Detection
Errors caused by signal attenuation, noise. Receiver detects errors
and signals retransmission or drops frame.
Error Correction
Receiver identifies and corrects bit error(s) without retransmission
(e.g., 2D parity).
Half/Full Duplex
Half-duplex: nodes can transmit but not at the same time. Full-duplex:
simultaneous transmission possible.
Host Link-Layer
Implementation:
The link layer is implemented in every host, typically on-chip or in the
Network Interface Card (NIC). It attaches to the host's
system buses and is a combination of hardware, software, and firmware.
The sending side encapsulates datagrams in frames; the receiving side
extracts datagrams and passes them up.
3. Error Detection and Correction
EDC (Error Detection and Correction) bits are added to
data bits (D) to protect against errors. Error detection is
not 100% reliable — protocols may miss some errors, but
rarely. Larger EDC fields yield better detection and correction.
Parity Checking
Single-bit parity: detect single bit errors by
adding one parity bit so the total number of 1s is even (or odd).
Two-dimensional parity: detect
and correct single bit errors using row and column parity
bits. The intersection of the error row and column identifies the
flipped bit.
Internet Checksum
Treat contents as sequence of 16-bit integers.
Checksum = one's complement sum of segment content.
Sender puts checksum value into checksum field.
Receiver computes checksum and compares.
Not equal → error detected. Equal → maybe errors still exist
(can't catch all).
Cyclic Redundancy Check (CRC)
CRC is the most powerful and widely used
error-detection method in practice (Ethernet, 802.11 WiFi). It uses a
generator polynomial to compute a remainder that is
appended to the data. The receiver divides the received frame by the
same polynomial — a non-zero remainder means an error was detected.
Key insight: CRC is computed in hardware by the NIC,
making it fast enough for multi-gigabit links. The generator polynomial
is standardized (e.g., CRC-32 for Ethernet).
4. Multiple Access Protocols
Two types of links: point-to-point (Ethernet switch to
host, PPP dial-up) and broadcast (shared wire or
medium: old Ethernet, WiFi, 4G/5G, satellite, HFC upstream).
Collision:
When two or more nodes transmit simultaneously on a shared channel,
their signals interfere — this is a collision. A multiple access
protocol is a distributed algorithm that determines how
nodes share the channel. Critically, coordination must use the channel
itself — there is no out-of-band channel.
Ideal Multiple Access Protocol
When one node wants to transmit, it can send at rate R.
When M nodes want to transmit, each can send at average rate R/M.
Fully decentralized: no special node to coordinate, no clock
synchronization.
Simple to implement.
MAC Protocols: Taxonomy
Category
Mechanism
Examples
Channel Partitioning
Divide channel into smaller pieces (time, frequency, code);
allocate piece to node for exclusive use
TDMA, FDMA, CDMA
Random Access
Channel not divided; allow collisions and recover from them
ALOHA, Slotted ALOHA, CSMA, CSMA/CD, CSMA/CA
Taking Turns
Nodes take turns; nodes with more to send can take longer turns
Polling, Token Passing
Channel Partitioning: TDMA & FDMA
TDMA
Time Division Multiple Access.
Access to channel in "rounds."
Each station gets fixed-length slot in each round.
Unused slots go idle — inefficient at low load.
FDMA
Frequency Division Multiple Access.
Channel spectrum divided into frequency bands.
Each station assigned fixed frequency band.
Unused transmission time goes idle.
Random Access Protocols
Slotted ALOHA
All frames same size; time divided into equal slots.
Nodes transmit only at slot beginnings.
If collision: retransmit in each subsequent slot with probability
p.
Pros: single active node can transmit at full
rate; highly decentralized; simple.
No slots; transmit immediately when frame is ready.
Even simpler than slotted ALOHA.
Max efficiency: 1/(2e) ≈ 18%
Worse than slotted ALOHA due to unbounded collision window.
CSMA and CSMA/CD
CSMA
Carrier Sense Multiple Access: listen before
transmit.
If channel idle → transmit entire frame.
If channel busy → defer transmission.
Collisions can still occur due to propagation delay (nodes may not
hear each other's transmission).
CSMA/CD
CSMA with Collision Detection: used in Ethernet.
Collisions detected within short time; transmissions aborted,
reducing channel wastage.
Collision detection easy in wired networks, difficult in wireless.
Uses binary exponential backoff after collisions.
Ethernet CSMA/CD Algorithm:
1. Receive datagram from network layer, create frame.
2. If channel idle → transmit. If busy → wait until idle, then
transmit.
3. If entire frame transmitted without collision → done!
4. If collision detected → abort, send jam signal.
5. Enter binary exponential backoff: after mth collision, choose K at
random from {0, 1, 2, ..., 2^m - 1}, wait K·512 bit times, then return
to step 2.
"Taking Turns" Protocols
Polling
Centralized controller "invites" other nodes to transmit in turn.
Used with "dumb" devices (e.g., Bluetooth).
Concerns: polling overhead, latency, single point of failure.
Token Passing
Control token message passed from one node to next sequentially.
Node transmits only while holding token.
Concerns: token overhead, latency, single point of failure (lost
token).
Used in FDDI, token ring.
Cable Access Network
(DOCSIS):
DOCSIS (Data Over Cable Service Interface Specification) is the protocol
used by cable ISPs (like your home cable internet). It cleverly
combines FDM, TDM, and random access:
Downstream: Multiple FDM channels (up to 1.6 Gbps
each), broadcast to all homes.
Upstream: Multiple channels (up to 1 Gbps), shared
via TDM and random access.
The CMTS (Cable Modem Termination System) sends a
MAP frame telling modems which upstream minislots
are reserved and which are open for contention.
Contention slots use random access with binary backoff — similar to
Ethernet!
5. LAN Addressing and ARP
MAC Addresses
32-bit IP Address
Network-layer address for interface.
Used for layer 3 forwarding.
Example: 128.119.40.136
Not portable — depends on IP subnet.
48-bit MAC Address
Used "locally" to get frame from one interface to another
physically-connected interface.
Burned into NIC ROM, sometimes software-settable.
Example: 1A-2F-BB-76-09-AD
Flat and portable — can move interface from one
LAN to another.
Analogy: MAC = Social Security Number; IP = postal address.
MAC Address Allocation:
Administered by IEEE. Manufacturers buy portions of MAC address space to
assure uniqueness. The broadcast MAC address is
FF-FF-FF-FF-FF-FF.
ARP: Address Resolution Protocol
Question: How to determine an interface's MAC address,
knowing its IP address?
Each IP node (host, router) on a LAN has an
ARP table containing IP/MAC address mappings.
ARP table entry: <IP address; MAC address; TTL> (TTL typically
20 minutes).
If destination MAC not in ARP table: sender
broadcasts ARP query (dest MAC = FF-FF-FF-FF-FF-FF).
Target node replies with ARP response containing its MAC address.
Sender caches the mapping in its ARP table.
ARP Operation: Broadcast Query →
Unicast Reply
Routing to Another Subnet
When sending a datagram from A to B via router R:
A creates IP datagram with source A, destination B.
A creates link-layer frame with
router R's MAC address as destination (not B's!).
Frame sent from A to R; R extracts datagram, passes to IP layer.
R creates new frame with B's MAC address as
destination, forwards to B.
Key Point: MAC
addresses are used hop-by-hop, while IP addresses remain end-to-end.
Each link along the path has its own source/destination MAC addresses,
but the IP source and destination stay constant.
6. Ethernet
Ethernet is the dominant wired LAN technology. First
widely used LAN; simple and cheap. Kept up with speed race: 10 Mbps →
400 Gbps. Single chip supports multiple speeds.
A Bit of History:
Ethernet was invented by Bob Metcalfe at Xerox PARC in
the 1970s. He sketched the original concept on a napkin! Metcalfe later
founded 3Com and was awarded the
Turing Award in 2022 for his pioneering work on
Ethernet. The name comes from the hypothetical "luminiferous ether" —
the medium once thought to carry light waves.
Ethernet Physical Topology
Bus (Old)
Popular through mid-90s.
All nodes in same collision domain.
Coaxial cable.
Switched (Today)
Active link-layer switch in center.
Each "spoke" runs separate Ethernet protocol.
Nodes do not collide with each other.
Full duplex operation possible.
Ethernet Frame Structure
Ethernet Frame Format (802.3)
Preamble (8 bytes) | Dest MAC (6) | Source MAC (6) | Type (2) | Data (payload) | CRC (4)
• Preamble: 7 bytes of 10101010 + 1 byte of 10101011 (synchronize clocks)
• Addresses: 6-byte source and destination MAC addresses
• Type: indicates higher-layer protocol (mostly IP)
• CRC: Cyclic Redundancy Check — if error detected, frame dropped
Ethernet is Unreliable and
Connectionless:
• Connectionless: no handshaking between sending and
receiving NICs.
• Unreliable: receiving NIC doesn't send ACKs or NAKs.
Dropped frames recovered only if higher-layer RDT (e.g., TCP) is
used.
• MAC protocol: unslotted CSMA/CD with binary
backoff.
• Many different Ethernet standards exist with common MAC protocol but
different speeds and physical media.
7. Ethernet Switches
A switch is a link-layer device that takes an active
role in forwarding frames.
Store and forward Ethernet frames.
Examine incoming frame's MAC address, selectively forward to one or
more outgoing links.
Transparent: hosts are unaware of switches.
Plug-and-play, self-learning: switches do not need to
be configured.
Multiple Simultaneous Transmissions
Hosts have dedicated, direct connection to switch.
Switches buffer packets.
No collisions; full duplex operation.
Each link is its own collision domain.
A-to-A' and B-to-B' can transmit simultaneously, without collisions.
Self-Learning Switch
When frame received, switch "learns" location of sender: records
sender MAC / incoming interface pair in switch table.
Index switch table using destination MAC address.
If entry found for destination:
If destination on same segment → drop frame (filtering).
Else → forward frame on indicated interface.
If no entry found → flood (forward on all interfaces
except arriving interface).
Self-Learning Switch: Building the
Forwarding Table
Switch Table Entry: (MAC
address of host, interface to reach host, timestamp). Entries expire
after a timeout (similar to ARP TTL). Switches can be interconnected;
self-learning works the same way across multiple switches.
Switches vs. Routers
Feature
Switches (Link Layer)
Routers (Network Layer)
Layer
Link layer (Layer 2)
Network layer (Layer 3)
Headers examined
MAC addresses
IP addresses
Forwarding table
Learned via flooding/self-learning
Computed using routing algorithms (OSPF, BGP)
Addresses used
MAC addresses
IP addresses
Broadcast handling
Floods broadcasts
Does not forward broadcasts across networks
8. Virtual LANs (VLANs)
As LANs scale, a single broadcast domain causes
problems: all layer-2 broadcast traffic (ARP, DHCP, unknown MAC) must
cross the entire LAN, leading to efficiency, security, and privacy
issues.
Motivation
Scaling: broadcast traffic consumes bandwidth across
entire LAN.
Administrative: users may move physically but want to
remain logically attached to their original department (e.g., CS user
moves to EE building).
Security/Privacy: separate traffic between
departments.
Port-Based VLANs
Switch ports grouped by management software so a single physical
switch operates as multiple virtual switches.
Traffic isolation: frames to/from ports 1-8 can only
reach ports 1-8.
Dynamic membership: ports can be dynamically assigned
among VLANs.
Forwarding between VLANs: done via routing (vendors
sell combined switches + routers).
VLAN Trunking: Extending VLANs
Across Switches
VLANs Spanning Multiple Switches
Trunk port: carries frames between VLANs defined over
multiple physical switches.
Frames forwarded within VLAN between switches can't be vanilla 802.1
frames — must carry VLAN ID info.
802.1Q protocol: adds additional header fields for
frames forwarded between trunk ports, including a 12-bit VLAN ID
field.
EVPN / VXLAN: Ethernet
VPNs (or VXLANs) allow Layer-2 Ethernet switches to be logically
connected using IP as an underlay. Ethernet frames are carried within IP
datagrams between sites, "stretching" a Layer 2 network over Layer 3
infrastructure (RFC 7348). This is widely used in modern data centers
and cloud networks.
9. Link Virtualization: MPLS
Multiprotocol Label Switching (MPLS) is a link-layer
virtualization technology that provides high-speed IP forwarding using
fixed-length labels instead of longest-prefix matching.
Goal: faster lookup using fixed-length identifiers,
borrowing ideas from Virtual Circuit approach.
IP datagram still keeps IP address!
MPLS header: 20-bit label, 3-bit Exp, 1-bit S, 8-bit
TTL — inserted between Ethernet header and IP header.
MPLS Capable Routers
Also called label-switched routers.
Forward packets based only on label value (don't inspect IP address).
MPLS forwarding table is distinct from IP forwarding tables.
Traffic engineering: can use source and destination
addresses to route flows differently.
Fast reroute: pre-computed backup paths for quick
recovery from link failures.
MPLS Signaling
Modified OSPF/IS-IS link-state flooding carries info used by MPLS
routing (link bandwidth, reserved bandwidth).
Entry MPLS router uses RSVP-TE signaling protocol to
set up MPLS forwarding at downstream routers.
10. Data Center Networking
Data centers host 10's to 100's of thousands of hosts in close
proximity: e-business (Amazon), content servers (YouTube, Akamai),
search engines (Google).
Challenges
Multiple applications serving massive numbers of clients.
High reliability requirements.
Managing/balancing load; avoiding processing, networking, and data
bottlenecks.
Network Elements
Server Racks 20-40
server blades (hosts) per rack.
Top of Rack (TOR) Switches One per rack; 100G-400G Ethernet to blades.
Tier-2 (Aggregation)
Switches Connecting to ~16 TORs below.
Tier-1 (Core) Switches Connecting to ~16 Tier-2 switches below.
Border Routers Connections outside the data center.
Modern Topologies
Leaf-Spine: Two-layer interconnection network. Leaf
switches connect to TORs; spine switches connect leaves. Provides rich
interconnection among racks.
Facebook F16: Each TOR connects to 16 fabric
switches; each fabric connects to 16 spine switches.
Multipath: Multiple routing paths possible between
racks → increased throughput and reliability via redundancy.
Protocol Innovations
Link layer: RoCE (Remote DMA over Converged
Ethernet).
Transport layer: ECN used in DCTCP, DCQCN congestion
control; experimentation with hop-by-hop backpressure.
Routing/Management: SDN widely used; place related
services close together to minimize tier communication.
Load balancer: Application-layer routing that
receives external requests, directs workload within data center, and
returns results (hiding internals).
11. Synthesis: A Day in the Life of a Web
Request
Our journey down the protocol stack is now complete! Let's review the
protocols involved in a seemingly simple scenario: a student attaches a
laptop to campus network and requests www.google.com.
Phase 1: Connecting to the Internet (DHCP)
Laptop needs IP address, first-hop router address, DNS server address
→ uses DHCP.
DHCP request encapsulated in UDP → IP → 802.3 Ethernet.
Ethernet frame broadcast (dest: FF-FF-FF-FF-FF-FF) on
LAN, received at router running DHCP server.
DHCP server formulates DHCP ACK with client's IP, router IP, DNS
server name/IP.
Client now has IP address, knows DNS server, and first-hop router.
Phase 2: ARP (Before DNS, Before HTTP)
Before sending HTTP request, need IP address of www.google.com →
DNS.
To send DNS query to router, need router's MAC address →
ARP.
ARP query broadcast; router replies with ARP reply giving its MAC
address.
Client caches MAC address and sends frame containing DNS query.
Phase 3: Using DNS
IP datagram containing DNS query forwarded via LAN switch to first-hop
router.
IP datagram forwarded from campus network into ISP network, routed
(using RIP, OSPF, IS-IS, BGP) to DNS server.
DNS replies with IP address of www.google.com.
Phase 4: TCP Connection & HTTP
Client opens TCP socket to web server (3-way
handshake: SYN → SYNACK → ACK).
TCP SYN segment inter-domain routed to web server.
HTTP request sent into TCP socket; IP datagram routed
to www.google.com.
Web server responds with HTTP reply containing web
page.
Instructions: Answer all questions in a separate
document (PDF or Word). Submit via the learning platform. This
assignment counts towards your final grade (5%). Provide clear,
well‑structured answers using terminology from the lecture.
Part I: Short Essays (40 points)
Describe the services provided by the link layer. Why is reliable
data transfer at the link layer seldom used on wired links but often
used on wireless links?
Explain the difference between single-bit parity and two-dimensional
parity. Which one can correct errors, and how?
Compare and contrast TDMA, FDMA, and random access protocols. In
which scenarios is each most efficient?
Describe the CSMA/CD protocol used in Ethernet. What happens when a
collision is detected, and how does binary exponential backoff work?
Explain how ARP works. Why does a node broadcast an ARP query
instead of sending it directly to the target?
Part II: True/False + Correction (30 points)
The link layer is responsible for end-to-end delivery of datagrams.
(True / False)
CRC can detect all burst errors less than r+1 bits, where r is the
number of CRC bits. (True / False)
Slotted ALOHA has a maximum efficiency of approximately 37%.
(True / False)
Ethernet switches need to be manually configured with MAC address
tables. (True / False)
In a VLAN, traffic between different VLANs can be forwarded directly
by the switch without routing.
(True / False)
For each false statement, write the correct version.
Part III: Problem Solving (30 points)
A node uses CRC with generator G = 1001 (r = 3). The data bits are D
= 101110. Compute the CRC bits R that should be transmitted. Show
your work using modulo-2 division.
Switch Simulation: A switch starts with an empty
table. Three frames arrive in sequence:
Frame 1: Source MAC = A1-B2-C3, Destination MAC = D4-E5-F6,
arriving on interface 1
Frame 2: Source MAC = D4-E5-F6, Destination MAC = A1-B2-C3,
arriving on interface 2
Frame 3: Source MAC = G7-H8-I9, Destination MAC = A1-B2-C3,
arriving on interface 3
For each frame, show:
What the switch learns (table update)
What action the switch takes (forward to which interface, flood,
or filter/drop)
The state of the switch table after processing the frame
Consider a network where host A (IP: 192.168.1.10, MAC:
AA-AA-AA-AA-AA-AA) wants to send a datagram to host B (IP:
192.168.1.20, MAC: BB-BB-BB-BB-BB-BB). However, B is on a different
subnet connected via router R (IP on A's subnet: 192.168.1.1, MAC:
RR-RR-RR-RR-RR-RR). Describe the MAC addresses in the frames at each
hop from A to B via R.
Grading criteria: correctness, completeness, proper
use of terminology, and clarity of explanation.
Deadline: Two weeks from the lecture date.
Chapter 6 Summary
Link Layer: transfers datagrams between physically
adjacent nodes. Services: framing, link access, reliable delivery,
flow control, error detection/correction, half/full duplex.
Error Detection/Correction: parity checking
(single-bit, 2D), Internet checksum, CRC (most powerful; used in
Ethernet, WiFi).
LAN Addressing: 48-bit MAC addresses (flat, portable)
vs. 32-bit IP addresses (hierarchical). ARP resolves IP to MAC.
Ethernet: dominant wired LAN. CSMA/CD with binary
exponential backoff. Frame structure: preamble, MAC addresses, type,
data, CRC. Invented by Bob Metcalfe (Turing Award 2022).
Switches: self-learning, plug-and-play.
Forward/filter based on MAC address table. Flood when destination
unknown. Each port is its own collision domain.
VLANs: partition broadcast domains logically.
Port-based VLANs, trunk ports, 802.1Q tagging. Require Layer-3 device
for inter-VLAN routing. EVPN/VXLAN for L2 over L3.
MPLS: link virtualization using fixed-length labels
for fast forwarding and traffic engineering.
Data Center Networks: leaf-spine topologies,
TOR/aggregation/core switches, multipath, SDN, load balancing.
Synthesis: a web request involves DHCP, ARP, DNS,
TCP, HTTP across all layers of the protocol stack.
Self‑review questions (exam
preparation):
• Why are MAC addresses flat while IP addresses are hierarchical?
• How does a switch build its forwarding table without configuration?
• What is the difference between CSMA and CSMA/CD?
• Why do VLANs require a router (or layer-3 switch) for inter-VLAN
communication?
• List all protocols involved from the moment you open a browser to when
a web page appears.
• What is the purpose of the Ethernet preamble and why is the minimum
frame size 64 bytes?