COMPUTER NETWORKS / 1. PHYSICAL & DATA LINK

Physical & Data Link Layer

Bits on a wire, MAC addresses, Ethernet frames, and switches


EXPLANATION

The Physical Layer is about transmitting raw bits across a medium. It defines voltages, light pulses, radio frequencies, and timing. It doesn't care what the bits mean — just how to represent 0s and 1s physically.

Physical media:
• Twisted pair copper (Cat5e, Cat6) — most office networks, up to 10 Gbps
• Fiber optic — light pulses through glass, up to 100 Gbps, immune to interference, used for backbone and datacenter
• Coaxial cable — cable TV, older Ethernet
• Radio (WiFi 802.11) — same data, transmitted as radio waves at 2.4 GHz or 5 GHz
• The medium doesn't change what's above — Ethernet frame is the same over copper or fiber

The Data Link Layer solves a specific problem: you have a physical link between two directly-connected devices. How do you identify them? How do you know where one frame ends and another begins? How do you detect errors?

MAC Address (Media Access Control):
• A 48-bit hardware address burned into every NIC at manufacture
• Format: 6 pairs of hex digits — e.g. A1:B2:C3:D4:E5:F6
• First 3 bytes = OUI (Organizationally Unique Identifier) — identifies the manufacturer
• Last 3 bytes = device-specific identifier
• MAC addresses are only meaningful on the local network segment. They don't cross routers — routers strip and replace MAC headers

Ethernet Frame structure:
• Preamble (8 bytes) → synchronization
• Destination MAC (6 bytes) → who this is for
• Source MAC (6 bytes) → who sent it
• EtherType (2 bytes) → what's inside (0x0800 = IPv4, 0x86DD = IPv6, 0x0806 = ARP)
• Payload (46–1500 bytes) → the IP packet
• FCS (4 bytes) → CRC checksum for error detection

ARP (Address Resolution Protocol): bridges Layer 2 and Layer 3. When your computer knows the IP address of the next hop but needs the MAC address to construct the Ethernet frame, it broadcasts: "Who has IP 192.168.1.1? Tell me your MAC." The target replies with its MAC. ARP results are cached in the ARP table.

Switches operate at Layer 2. They learn which MAC addresses are on which port and forward frames only to the right port. This is why a switch is smarter than a hub (which broadcasts to all ports).

DIAGRAM

ETHERNET FRAME STRUCTURE (up to 1518 bytes):
  ┌──────────┬──────────┬──────────┬─────────┬───────────────┬─────┐
  │ Preamble │ Dest MAC │  Src MAC │EtherType│    Payload    │ FCS │
  │  8 bytes │  6 bytes │  6 bytes │ 2 bytes │ 46–1500 bytes │ 4 B │
  └──────────┴──────────┴──────────┴─────────┴───────────────┴─────┘

  SWITCH vs ROUTER:
  Switch (Layer 2):             Router (Layer 3):
  • Reads MAC addresses         • Reads IP addresses
  • Forwards within LAN         • Routes between networks
  • Maintains MAC table         • Maintains routing table
  • Does NOT change MACs        • DOES change MACs at each hop

  ARP RESOLUTION:
  You know: IP = 192.168.1.1 (your gateway)
  Need:     MAC address to build the Ethernet frame

  Broadcast: "Who has 192.168.1.1?"  → all devices on LAN
  Reply:     "I have it, my MAC is AA:BB:CC:DD:EE:FF"
  Cache:     ARP table stores this mapping
  Build:     Ethernet frame with dst MAC = AA:BB:CC:DD:EE:FF

CODE

PYTHON
1# ── View your MAC address ─────────────────────────────
2ip link show # Linux — look for "link/ether"
3ifconfig en0 # Mac — look for "ether"
4
5# ── View ARP cache (IP → MAC mappings on your LAN) ────
6arp -a # all entries
7arp -n 192.168.1.1 # specific IP
8
9# ── Python: inspect MAC & frame basics ────────────────
10import uuid
11import socket
12
13# Get your MAC address
14mac = uuid.getnode()
15mac_str = ':'.join(f'{(mac >> (8*i)) & 0xff:02x}' for i in reversed(range(6)))
16print(f"MAC address: {mac_str}")
17
18# Get your local IP
19hostname = socket.gethostname()
20local_ip = socket.gethostbyname(hostname)
21print(f"Local IP: {local_ip}")
22
23# ── Scapy: craft and send actual Ethernet frames ───────
24# pip install scapy
25from scapy.all import Ether, ARP, srp
26
27# ARP scan — find all devices on your LAN
28packet = Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(pdst="192.168.1.0/24")
29answered, _ = srp(packet, timeout=2, verbose=False)
30
31print("Devices on your network:")
32for sent, received in answered:
33 print(f" IP: {received.psrc:15s} MAC: {received.hwsrc}")
← PREVOverviewNEXT →2. Network Layer — IP