Data Link Layer and LAN Technologies
This domain tests Ethernet mechanics, switching behaviour, VLANs, spanning tree, wireless LANs and point-to-point link protocols. It is the most configuration-adjacent of the lower-layer domains.
Ethernet framing and MAC
- Frame: 7-byte preamble, 1-byte SFD, 6-byte destination and source MAC, 2-byte Type/Length, 46–1500-byte payload, 4-byte FCS. Minimum frame 64 bytes, maximum 1518 bytes (excluding preamble), so the minimum payload is 46 bytes after padding.
- MAC addresses are 48 bits; a traditional globally administered 48-bit address can contain a 24-bit OUI, while local/randomized addressing and other assignment blocks require care.
- CSMA/CD applies to half-duplex shared media only; full-duplex switched links do not use it.
Switching and VLANs
- A switch learns source MACs into its CAM table, floods eligible unknown-unicast and broadcast traffic within the VLAN, while multicast forwarding can be constrained by snooping and policy, and filters by destination port.
- Each switch port is its own collision domain; a VLAN is a broadcast domain.
- 802.1 Q inserts a 4-byte tag; the VID field is 12 bits, giving usable IDs 1–4094 (0 and 4095 reserved). In a basic untagged-access/802.1 Q-trunk classroom model, access traffic belongs to one VLAN and trunks carry permitted VLANs. Native-VLAN tagging and voice-VLAN behavior depend on configuration and platform.
- Inter-VLAN routing needs a Layer 3 device: router sub-interfaces (one per VLAN, 802.1 Q encapsulation) or a Layer 3 switch with SVIs.
Spanning Tree
- 802.1 D elects one root bridge by lowest bridge ID (priority in 4096 steps, default 32768, then MAC). Each non-root bridge selects one root port by lowest path cost, then lowest sender bridge ID, then lowest port ID.
- Port states: blocking, listening, learning, forwarding; convergence takes 30–50 s. RSTP (802.1 w) reduces this to seconds with discarding/learning/forwarding states.
WLAN and link protocols
- 802.11 b/g use 2.4 GHz, 802.11 a/ac use 5 GHz, 802.11 n uses both with MIMO, 802.11 ax is Wi-Fi 6. Access uses CSMA/CA with acknowledgement.
- Security evolution: WEP (broken) → WPA/TKIP → WPA 2/AES-CCMP → WPA 3.
- PPP carries LCP for link setup, NCP for network-layer parameters, and PAP or CHAP for authentication (CHAP uses a challenge and is the safer choice). HDLC is a simpler bit-oriented framing protocol.
Worked example
Three switches form a triangle. SW 1 priority 4096, SW 2 and SW 3 default 32768 with MACs 00-00-0 C-AA-AA-AA and 00-00-0 C-BB-BB-BB. SW 1 wins on priority and becomes root. On SW 2, the path to SW 1 is one hop (cost 19 for 100 Mbps), while the path via SW 3 is two hops (38), so SW 2’s direct link to SW 1 is its root port. On the SW 2-SW 3 segment the designated side is selected by the complete STP comparison, including root path cost and bridge ID before any final port-ID tie-break.
Traps that cost marks
- Claiming a switch blocks broadcasts.
- Quoting VLAN range as 1–4095 rather than 1–4094.
- Forgetting that a native VLAN mismatch on a trunk causes a CDP/STP warning and possible traffic leakage.
- Using CSMA/CD to explain full-duplex switched Ethernet.