1st Principles
Menu

Networking · 30 min read

Link Layer

How neighboring machines on a local segment deliver frames using MAC addresses, shared media rules, and link-specific framing before IP routing enters the picture.

Why this exists

Before a packet can cross the world, it must cross the room. Bits need a physical or wireless medium, a framing format so receivers know where a frame starts and ends, and a local address so the right neighbor accepts the frame.

The link layer solves neighbor delivery: Ethernet on a switch fabric, Wi-Fi on a radio cell, and similar technologies on other media. IP assumes some link beneath it can hand a packet to the next hop. Without that local hop, global routing is a fantasy.

Studying the link layer prevents a common confusion: IP addresses do not magically move bits onto wire. On each hop, something link-local maps 'next hop IP' to 'next hop MAC' and ships a frame.

Axioms & primitives

  1. 01A link connects neighbors; the internet is many links glued by routers.
  2. 02Frames are the link layer's unit; they carry link addresses (often MAC addresses) and a payload (often an IP packet).
  3. 03MAC addresses identify interfaces on a local network segment; they are not global routing locators.
  4. 04Switches forward frames using learned MAC tables; routers forward packets using IP prefixes.
  5. 05Shared media need rules for who transmits when (CSMA/CA on Wi-Fi, historically CSMA/CD on classic Ethernet).
  6. 06ARP (IPv4) and Neighbor Discovery (IPv6) bind next-hop IP addresses to link-layer addresses.

Learning objectives

After this lesson you should be able to:

  • Explain the difference between a MAC address and an IP address in terms of scope and job.
  • Describe what a switch learns and how that differs from what a router looks up.
  • Trace one hop: from 'send IP packet to next hop X' to 'Ethernet frame to MAC Y'.
  • State why Wi-Fi collisions and airtime sharing create different failure modes than a wired switched Ethernet.
  • Predict what happens if ARP cache poisoning succeeds on a local LAN.

Progressive depth

Read the layers in order for a full explanation. Or open the layer you need.

01

Intuition

Your laptop does not beam IP packets into the void. It wraps each outgoing IP packet in a local frame addressed to the next hop it can actually touch: usually your home router on Wi-Fi or Ethernet.

That next hop unwraps the frame, looks at the IP destination, chooses a new next hop, and wraps a fresh frame for the following link. Cross the internet and you cross many such local deliveries. Global addressing is IP; local delivery is the link layer.

When people say 'the network is down' and mean 'I cannot associate to Wi-Fi,' they are pointing at the link layer even if they blame 'the internet.'

02

Formal shape

Ethernet frames typically carry destination MAC, source MAC, ethertype (what payload is inside, e.g. IPv4/IPv6), payload, and a frame check sequence. Switches learn source MACs behind ports and forward unknown unicast by flooding within the VLAN.

Wi-Fi (IEEE 802.11) adds association to an access point, link encryption (WPA families), acknowledgments at the link layer, and contention for airtime. Frames can be retransmitted locally without TCP knowing.

IPv4 uses ARP: broadcast 'who has 192.168.1.1?' and cache the reply. IPv6 uses Neighbor Discovery with ICMPv6. Both bindings are soft state: wrong caches cause silent misdelivery on the LAN.

VLANs tag frames so one physical switch fabric can host multiple isolated broadcast domains. Mis-tagging is a classic 'it works on my port' outage.

Local delivery, then rewrap

Click a stage to see the link-local handoff this page uses: frame to next hop, then a fresh wrap onward.

Loading diagram...

Select a stage to read the boundary detail.

03

Worked examples

Home path: laptop Wi-Fi frame to AP/router MAC; router forwards IP toward ISP; WAN link uses whatever framing the ISP requires (often Ethernet again, sometimes PPPoE).

Same-subnet transfer: two hosts on 192.168.1.0/24 talk via switch without the router rewriting IP. ARP resolves peer MACs; frames go host to host (or via AP).

Different-subnet transfer: host ARPs for the gateway, not for the distant IP. Beginners who ARP for a public address on the LAN are confusing link scope with internet scope.

Failure lab: unplug the cable and TCP stalls; associate to the wrong SSID and you may have a perfect link to the wrong network; poison ARP and you can become a local man-in-the-middle.

04

Edge cases

Jumbo frames raise MTU on carefully controlled fabrics; mix them with standard MTU and you create black holes. Link aggregation bonds ports for bandwidth/failover but needs consistent hashing.

Wireless hidden terminals and interference create loss that looks like congestion to TCP. Link-layer retries can inflate latency before TCP ever retransmits.

MAC addresses were meant as durable interface identifiers; privacy features now randomize them on many client OSes. Do not build access control that assumes a forever MAC.

Bridges and switches can loop without spanning tree or a modern equivalent; a looped L2 domain melts into a broadcast storm. That failure mode does not exist in the same way at pure L3.

Mental models

  • Room vs city

    Link layer is how you hand a note to someone in the same room. IP is how the note finds a building across the city. Routers are doorways between rooms.

  • Shipping pallet label

    The Ethernet header is the pallet label used inside one warehouse. At the next warehouse, workers slap on a new pallet label. The box inside (IP packet) keeps its destination address.

  • Reception desk directory

    ARP/ND is asking the front desk: 'What badge number (MAC) corresponds to office 10.0.0.5 right now?'

Common misconceptions

  • Myth

    MAC addresses route across the internet like IP addresses.

    Reality

    MAC addresses are local to a link. Routers strip and rewrite link headers at each hop; only IP (or an outer tunnel header) survives across networks.

  • Myth

    A switch is just a slower router.

    Reality

    A switch forwards on link-layer addresses inside a broadcast domain. A router forwards on network-layer addresses between networks and usually ends a broadcast domain.

  • Myth

    Wi-Fi is 'just Ethernet without cables,' so all Ethernet mental models transfer unchanged.

    Reality

    Framing and IP-over-link ideas transfer; the shared radio, association, roaming, and airtime contention do not.

  • Myth

    If the cable lights are on, the link layer is healthy for my app.

    Reality

    Carrier sense is necessary but not sufficient. Duplex mismatches, VLAN mis-tags, and Wi-Fi interference can pass 'link up' while dropping useful frames.

Exercises

Work these without looking up answers first. Check yourself against the intent notes.

  1. Exercise 01

    A host wants to reach 203.0.113.9; its gateway is 192.168.1.1. Which address does it ARP for, and what is inside the Ethernet frame's IP header destination field?

    What good looks like

    ARP for 192.168.1.1 (gateway MAC). IP destination remains 203.0.113.9. Demonstrates link next-hop vs packet destination.

  2. Exercise 02

    Explain why a switch flood of unknown unicast is not the same thing as IP routing to the internet.

    What good looks like

    Flooding stays in a broadcast domain using MAC learning; IP routing chooses next hops across networks using prefixes and does not flood the world.

  3. Exercise 03

    You can ping your gateway but not a LAN neighbor. List two link-layer or L2 isolation causes worth checking before blaming IP routing.

    What good looks like

    Wrong VLAN, AP client isolation, switch ACL/port security, bad ARP entry, private WLAN client isolation.

Sources & further reading

External references. Prefer primary documents and clear explainers.

Go deeper on your own

These picks go past the foundation in this lesson. Use them when you want a primary spec, official docs, or a longer walkthrough.