🔗 Phase 2 · Data Link 🟡 Beginner+ MODULE 06

Data Link Layer

⏱️ 2.5 hours

📖 Theory + IOS Examples

🧩 10 Questions

Phase 2 progress0%

🎯 What you'll learn: The Data Link layer's purpose and sublayers (LLC and MAC), physical and logical topologies, WAN topologies, LAN topologies, half vs full duplex, and contention-based access methods (CSMA/CD and CSMA/CA).

Section 1

Data Link Layer Purpose

Layer 2 — the Data Link layer sits between the Physical layer (cables, signals) and the Network layer (IP routing). Its job is to provide access to the physical media and get frames reliably from one node to the next on the same network segment.

Encapsulates Layer 3 packets into frames — adds an L2 header and trailer
Controls how data is placed onto the physical medium and received from it
Provides error detection (not correction) using CRC in the frame trailer
Uses MAC addresses for device identification within a network segment
Manages media access to prevent or handle collisions

OSI Layer — Data Link

LLC

802.2 — Upper sublayer

MAC

Lower sublayer — media access

Frame

L2 PDU — encapsulates L3 packet

The IEEE 802 standard divides the Data Link layer into two sublayers:

LLC — 802.2

Logical Link Control

Upper sublayer. Communicates with Network layer protocols above. Identifies which network-layer protocol is encapsulated in the frame (IPv4, IPv6, ARP). Provides the interface between the upper and lower layers.

MAC — 802.3/11/15

Media Access Control

Lower sublayer. Handles two key functions: (1) encapsulation/de-encapsulation of frames with MAC addresses, and (2) media access control — deciding when/how devices can transmit onto the shared medium.

CRC / FCS

Error Detection

CRC (Cyclic Redundancy Check) is calculated over the frame and placed in the FCS trailer field. Receiver recalculates — if mismatch, frame is silently dropped. L2 detects but does NOT correct errors.

Section 2

Network Topologies

A physical topology describes the actual physical layout of the media and devices (where the cables go). A logical topology describes how data actually flows through the network — the path traffic takes. These can differ: a physical star can behave as a logical bus (as in old hub-based Ethernet).

WAN Topologies

Point-to-Point

P2P — Simplest WAN

Direct dedicated link between exactly two nodes. All bandwidth is available to those two endpoints — no contention, no shared medium concerns. Most serial WAN links use this topology.

Hub and Spoke

Star WAN Topology

Central hub site connects to multiple remote spoke sites. All inter-spoke traffic must pass through the hub. Cost-effective for many remote sites but hub is a single point of failure and potential bottleneck.

Mesh

Full or Partial Mesh

Full mesh: every node connects to every other node — maximum redundancy but expensive (n×(n-1)/2 links). Partial mesh: some nodes have multiple connections — balance of redundancy and cost.

LAN Topologies

Bus

Legacy — 10BASE2 Coax

All devices connect to a single shared cable segment. Any device transmitting sends to all others. A break anywhere takes down the entire segment. Rarely seen — legacy only.

Star

Most Common Today

All devices connect to a central switch. Each device gets its own dedicated link. A single device or cable failure does not affect others. Used in virtually all modern Ethernet LANs.

Extended Star

Enterprise LAN Design

Multiple switches interconnected in a hierarchical tree. Core switch connects to distribution switches, which connect to access switches, which connect to end devices.

Ring

Token Ring / FDDI

Devices form a logical ring — data travels around the ring in one direction. Token Ring (IEEE 802.5) and FDDI used this. Legacy — not deployed in modern networks.

💡

Modern Ethernet uses Extended Star topology

Modern enterprise LANs use the Extended Star (hierarchical) design model: a core switch connects to distribution switches, which connect to access switches, which connect to end devices. This three-tier model provides scalability, redundancy, and manageability. Even small offices use at least a two-tier version: one aggregation switch connecting to access switches or directly to end devices.

Section 3

Half Duplex vs Full Duplex

Duplex describes whether a communication link can send and receive simultaneously. This is a critical concept for Ethernet performance — a duplex mismatch between two connected devices is one of the most common causes of poor network performance.

Half Duplex

One direction at a time — like a walkie-talkie
If one end transmits, the other must wait
Used in legacy hubs and wireless (802.11)
Collisions are possible — CSMA/CD required
Effective throughput is reduced

Full Duplex

Both directions simultaneously — like a phone call
Requires a dedicated path each way (switch port)
Used in all modern switched Ethernet
No collisions possible — CSMA/CD not needed
A 1 Gbps link = 1 Gbps send + 1 Gbps receive

IOS — checking duplex and detecting mismatch

IOS

SW1# show interfaces FastEthernet 0/1
FastEthernet0/1 is up, line protocol is up (connected)
  ...
  Full-duplex, 100Mb/s, media type is 10/100BaseTX
  ! Full-duplex and 100 Mbps — properly auto-negotiated

SW1# show interfaces FastEthernet 0/2
FastEthernet0/2 is up, line protocol is up (connected)
  Half-duplex, 10Mb/s    ! Mismatch! One end forced to 10 half
  ! Symptom: excessive collisions, input errors, late collisions
  ! Fix: set both ends to auto-negotiate or manually match both

⚠️

Duplex mismatch — silent performance killer

A duplex mismatch doesn't break connectivity — the link stays up — but performance degrades severely and you'll see late collisions in show interfaces output. The full-duplex side transmits freely; the half-duplex side detects collisions and backs off, causing retransmissions. Fix: always use duplex auto on both ends, or manually configure the same duplex on both sides.

Section 4

CSMA/CD — Wired Ethernet

CSMA/CD (Carrier Sense Multiple Access with Collision Detection) is the media access method used in half-duplex Ethernet — legacy hub-based networks. Although modern full-duplex switched networks don't experience collisions, CSMA/CD remains part of the IEEE 802.3 standard and is tested on the CCNA exam.

CSMA/CD Process Flow

Device has frame

→

Listen for traffic (Carrier Sense)

→

Medium idle?

YES

↓

Transmit frame

↓

Collision detected?

YES

Send JAM signal

Wait random backoff

Retry

Transmission complete

↓

Wait and retry

💡

Modern full-duplex switched Ethernet: no collisions

In a modern switched network where every device has a full-duplex connection to a switch port (no shared medium), collisions cannot occur. Each switch port is its own collision domain. CSMA/CD is still part of the 802.3 standard but effectively unused. You only see collisions on old hub-based segments or serial WAN interfaces still running half-duplex.

Section 5

CSMA/CA — Wireless 802.11

CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) is used in wireless (IEEE 802.11 Wi-Fi) networks. Unlike wired Ethernet, radio-based transmission makes collision detection impossible — a station transmitting cannot hear simultaneous transmissions from other stations. Instead, CSMA/CA focuses on avoiding collisions before they happen.

Step 1: Listen before transmitting (Carrier Sense) — if medium busy, wait
Step 2: If medium idle, wait a DIFS (Distributed IFS) period plus a random backoff to avoid simultaneous transmission
Step 3: Send an RTS (Request to Send) frame to the Access Point
Step 4: Wait for CTS (Clear to Send) reply from the AP
Step 5: Transmit the data frame
Step 6: Wait for ACK — if no ACK received, assume collision and retransmit

⚠️

Why wireless is slower than wired despite same theoretical speeds

CSMA/CA overhead (DIFS, backoff, RTS/CTS, ACKs) consumes significant bandwidth. Add half-duplex radio operation, interference, range limitations, and all clients sharing the same medium — and a 300 Mbps 802.11n link typically achieves only 150–200 Mbps real throughput. This overhead is the fundamental reason wireless LAN throughput is always lower than its theoretical maximum.

Section 6

Data Link Frame Structure

A Data Link frame wraps the Network layer packet with a header and a trailer. The header contains addressing and control information; the trailer contains error detection. The exact format varies by Layer 2 protocol (Ethernet, Wi-Fi, PPP), but all follow this general structure.

Frame Header

Dest MAC · Src MAC · EtherType

Data (Payload)

L3 Packet — 46 to 1500 bytes (Ethernet)

FCS

CRC — 4 bytes

Destination MAC

Frame Header

6-byte MAC address of the next-hop destination on the local segment. Can be unicast, multicast, or broadcast (FF:FF:FF:FF:FF:FF).

Source MAC

Frame Header

6-byte MAC address of the sending device's NIC. Switches use this to populate the MAC address table and learn port locations.

EtherType

Protocol Identifier

2-byte field identifying the encapsulated L3 protocol. 0x0800 = IPv4, 0x86DD = IPv6, 0x0806 = ARP. The LLC sublayer uses this information.

FCS / CRC

Frame Trailer

Frame Check Sequence — 4-byte CRC value calculated over the frame. Receiver recalculates; mismatch = frame silently dropped. Error detection only, not correction.

MTU = 1500

Max Transmission Unit

Maximum payload size in a standard Ethernet frame. Total frame with header/trailer ≈ 1518 bytes. Jumbo frames extend to 9000 bytes — used in storage networks.

Preamble

Clock Synchronization

7 bytes of alternating 1s and 0s before the frame. Allows receiving NIC to synchronize its clock to the transmitter. Followed by the 1-byte Start Frame Delimiter (10101011).

✨

MTU and jumbo frames

Standard Ethernet MTU = 1500 bytes payload. The total frame including headers and trailer is ~1518 bytes (or 1522 with an 802.1Q VLAN tag). Jumbo frames increase the MTU to up to 9000 bytes — used in storage area networks and high-performance computing to reduce CPU overhead from processing many small frames. All devices on the path must support jumbo frames for them to work.

🧩 Knowledge Check

10 questions — Data Link Layer

1. Which Data Link sublayer is responsible for communicating with upper-layer protocols?

2. Which topology provides the MOST redundancy?

3. Modern switched Ethernet LANs use which LAN topology?

4. What does "full duplex" mean?

5. CSMA/CD is used in:

6. What does the FCS field in a Data Link frame provide?

7. A duplex mismatch causes:

8. CSMA/CA is used by:

9. What is the maximum payload size of a standard Ethernet frame?

10. In CSMA/CD, what happens when a collision is detected?

Finished this module?

Mark it complete to track your progress.

Phase 2 · Data LinkModule 6 of 17