5.2 — The Physical & Link Layers: Wires, Frames, MAC Addresses & Switches

Two computers, one cable. That is the smallest possible network, and it already contains three hard problems.

How do you turn a number into something a wire can carry? A wire carries a voltage. A fibre carries light. Neither of those is a 1.

How does the receiver know where one bit ends and the next begins? If I hold the voltage high for a while, is that one 1, or five 1s in a row? The two machines have separate clocks, which drift.

And when there are three computers instead of two, how do they take turns? If two speak at once on a shared wire, both signals mix and both are destroyed.

This chapter is the answers, and it stays entirely below the internet. Nothing here knows what an IP address is.

1. Turning bits into signals

The simplest scheme, called NRZ (non-return to zero), is exactly what you would guess: high voltage means 1, low voltage means 0. It works, and it breaks on the second problem above.

Send 00000000 — eight zeros — and the line simply sits at low voltage for eight bit-times. The receiver, counting on its own clock, has to guess whether that was seven zeros, eight, or nine. Over a long run of identical bits the two clocks drift apart and the receiver loses count. This is the clock recovery problem, and it is the reason real encodings look stranger than they need to.

Manchester encoding solves it by making every bit contain a transition in the middle: a 0 is a high-to-low change, a 1 is a low-to-high change. Now there is a guaranteed edge in every single bit, so the receiver can re-synchronise its clock continuously and can never lose count. The cost is that the line changes state twice per bit, so you need twice the signalling rate for the same data rate — a 50% efficiency loss. Original 10 Mbit/s Ethernet used this.

Faster links use smarter schemes that keep most of the efficiency while guaranteeing enough transitions. 100 Mbit/s Ethernet uses 4B/5B: every 4 bits of real data is looked up in a table and sent as a 5-bit code, where the codes are chosen so that no valid sequence ever contains a long run of identical bits. That is 80% efficiency instead of 50%, and it still guarantees clock recovery. Gigabit Ethernet uses 8B/10B, and 10-gigabit uses 64B/66B, which is 97% efficient — the same idea pushed as far as it will go.

This is a real engineering trade you should be able to state: the extra bits are not waste, they are buying the receiver the ability to stay synchronised. Chapter 1.8's information theory is the formal frame for it — you are deliberately spending channel capacity on structure so the signal is decodable.

Why is bandwidth measured in bits per second and file sizes in bytes?

Because they come from different traditions. Communications engineering counted signal changes on a wire long before bytes existed, so it counts bits. Computing counts storage in bytes. This is why a "100 Mbps" connection downloads a file at about 12.5 MB/s — you divide by 8. Internet providers have never rushed to clarify this. Chapter 1.3 covers the related KB-versus-KiB confusion.

2. The frame: giving the bits a shape

A stream of bits is useless without boundaries. The link layer's unit is the frame, and an Ethernet frame looks like this:

┌──────────┬─────┬───────────┬──────────┬──────┬─────────────────┬─────┐
│ Preamble │ SFD │  Dest MAC │ Src MAC  │ Type │     Payload     │ FCS │
│  7 bytes │  1  │  6 bytes  │ 6 bytes  │  2   │  46–1500 bytes  │  4  │
└──────────┴─────┴───────────┴──────────┴──────┴─────────────────┴─────┘

Preamble — seven bytes of alternating 10101010. It carries no information at all. Its entire purpose is to give the receiver's clock-recovery circuit a run of clean, regular transitions to lock onto before the real data starts. It is a tuning note before the music.

SFD (start frame delimiter) — one byte, 10101011. That final 11 breaks the alternating pattern, and that break is the signal: the next bit is the first bit of the real frame. This is how the receiver knows exactly where the data begins.

Destination and source MAC — six bytes each. Section 3.

Type — two bytes saying what the payload is. 0x0800 means an IPv4 packet, 0x86DD means IPv6, 0x0806 means ARP. This is the "what comes next" field from Chapter 5.1, and it is what lets the receiver hand the payload to the right code.

Payload — 46 to 1,500 bytes. The upper limit is the MTU (maximum transmission unit), and 1,500 is the number to memorise because it shows up everywhere. The lower limit of 46 exists for a historical reason worth knowing (section 5), and short payloads are padded up to it.

FCS (frame check sequence) — four bytes holding a CRC-32 checksum computed over the whole frame. The receiver recomputes it; if it does not match, the frame was corrupted in transit and is silently discarded. Not repaired, not reported — dropped. Detecting errors is this layer's job; recovering from them is somebody else's, which is exactly the layering from Chapter 5.1 in action. TCP will notice the gap and re-send.

Why 1,500 bytes? It is a compromise chosen in the early 1980s and never changed. Bigger frames mean less header overhead per byte of data and fewer interrupts for the CPU. Smaller frames mean a corrupted frame wastes less, and one big frame cannot hog the wire while a latency-sensitive frame waits behind it. 1,500 was a reasonable middle for 10 Mbit/s coaxial cable, and it survived because changing it would require every device on every network to agree at once — the ossification from Chapter 5.1. Modern data centres do use jumbo frames of around 9,000 bytes, but only inside networks where a single operator controls every device.

The MTU matters far above this layer. Chapter 5.4 shows that a TCP segment must fit inside it, and Chapter 5.3 shows what happens when a packet is too big for a link somewhere in the middle of a route.

3. MAC addresses: a name burned into the hardware

Every network interface has a MAC address (media access control), six bytes, usually written as twelve hex digits: a4:83:e7:1f:00:9c.

The structure is meaningful:

• The first three bytes are the OUI (organisationally unique identifier), assigned by the IEEE to a manufacturer. a4:83:e7 is Apple. 00:1a:11 is Google. You can look up any device's maker from these three bytes.
• The last three bytes are chosen by that manufacturer, uniquely per device.

That split is what makes global uniqueness achievable without a central registry of every device ever made: the IEEE hands out prefixes, and each manufacturer takes responsibility for its own suffix space.

The two special bits. The lowest bit of the first byte is the multicast bit: if set, the frame is for a group rather than one device. All-ones (ff:ff:ff:ff:ff:ff) is broadcast — every device on the local network must accept it, and section 4 shows why that matters. The second-lowest bit marks a locally administered address, meaning "made up by software rather than assigned by a manufacturer".

MAC randomisation, and why your phone does it. A MAC address is a permanent, globally unique identifier that your device broadcasts constantly while looking for Wi-Fi networks. Shops installed sensors to track shoppers by it. So iOS and Android now generate a different random MAC per network. This is a genuine privacy fix and it occasionally breaks things — a network that filters by MAC address, or a captive portal that remembers you, sees a new device every time.

The crucial limitation: a MAC address has no geography. IP addresses are hierarchical, so a router can look at 142.250.187.238 and know roughly which direction to send it (Chapter 5.3). A MAC address is a flat, random-looking number. There is no way to look at a4:83:e7:1f:00:9c and know where it is. That is precisely why MAC addressing cannot scale beyond one local network, and precisely why the internet layer exists.

4. ARP: the shout that makes everything work

Here is the problem that trips up most people learning networking, and it is worth being slow about.

Your laptop wants to send a packet to 142.250.187.238. It builds an IP packet with that destination. But to actually put anything on the wire, it needs a frame, and a frame needs a destination MAC address. It has an IP address and needs a MAC address, and nothing so far connects the two.

ARP (Address Resolution Protocol) is the connection, and it works by shouting.

Your laptop broadcasts a frame to ff:ff:ff:ff:ff:ff — every device on the local network receives it — saying, in effect: "Who has 192.168.1.1? Tell 192.168.1.42."

Every device on the network reads it. Every device except the router ignores it. The router replies directly: "192.168.1.1 is at c8:3a:35:12:ab:cd."

Your laptop caches that mapping in its ARP table for a few minutes and can now build frames.

arp -a          # show the cached IP-to-MAC mappings
ip neigh        # the Linux equivalent

ARP in three steps. The request goes to everyone because the sender has no idea who to ask; the reply comes back to one address because the replier knows exactly who asked. The cached mapping is what makes this happen once every few minutes rather than on every packet.

Two things about ARP are worth taking seriously.

It only ever asks about the local network. If the destination IP is not on your subnet — and Chapter 5.3 explains exactly how "your subnet" is computed — then your laptop does not ARP for the destination at all. It ARPs for the router, and sends the frame there. The router then strips the frame, looks at the IP packet, and builds a completely new frame for the next hop. The MAC addresses change at every hop; the IP addresses do not. That single sentence is the clearest statement of how layers 2 and 3 relate, and it is a standard interview question.

ARP has no authentication whatsoever. Any device can reply to any request, or send an unsolicited reply that others will cache. This is ARP spoofing: an attacker on your network answers "the router is at my MAC address", and every machine that believes it starts sending its traffic through the attacker's machine. That is a man-in-the-middle attack, and it is trivially easy on an open network. The defences are all at higher layers — TLS (Chapter 5.7) means the attacker sees encrypted bytes they cannot read or modify — plus switch features like dynamic ARP inspection. The lesson generalises: the link layer was designed in an era when being physically on the wire implied you were trusted, and none of it is safe on a network you do not control. Chapter 8.5 covers this family properly.

5. Sharing the wire: collisions, CSMA and why 46 bytes

Original Ethernet was one long coaxial cable with every computer tapped into it. Everyone shared one wire, so two machines transmitting at once mixed their signals and destroyed both. This is a collision.

The protocol for handling it is CSMA/CD — carrier sense multiple access with collision detection — and it is worth reading as four rules, because it is one of the most elegant distributed algorithms ever deployed:

1. Carrier sense — before transmitting, listen. If the wire is busy, wait.
2. Multiple access — everyone has equal right to transmit; there is no coordinator.
3. Collision detection — while transmitting, keep listening. If what you hear is not what you sent, someone else started at the same moment.
4. Backoff — stop immediately, send a short jam signal so everyone notices, then wait a random time and retry. Each successive collision doubles the range the random wait is drawn from.

That last rule is binary exponential backoff, and it is the same idea as retry backoff in distributed systems (Chapter 10.9). The randomness is the essential part: if both machines waited the same fixed time they would collide again forever. Doubling the range each time means a lightly loaded network recovers almost instantly, while a heavily loaded one spreads out automatically.

Now the minimum frame size. A sender must still be transmitting when a collision reaches it, or it will never notice. The signal takes time to travel the cable and the collision takes time to travel back, so the sender must transmit for at least one full round trip. With the maximum specified cable length and the speed of signal propagation, that round trip works out to the time it takes to send 64 bytes at 10 Mbit/s. Subtract the 18 bytes of header and checksum and you get a 46-byte minimum payload.

So a number in the Ethernet frame format is a direct encoding of the speed of light and a maximum cable length. That is a genuinely lovely fact, and it is the kind of thing that makes a protocol suddenly make sense.

Collisions are extinct on modern wired networks, because switches replaced shared cable (section 6) and every link is now full duplex — separate paths for each direction, so two devices simply cannot collide. CSMA/CD is still in the specification and is effectively dead code.

Wi-Fi cannot use it at all, and the reason is physics. A radio transmitter cannot listen while transmitting — its own signal is millions of times stronger than anything it might hear. So Wi-Fi uses CSMA/CA, where CA is collision avoidance: listen first, wait a random time even when the channel seems free, and require an explicit acknowledgement for every frame. No acknowledgement means the frame was lost, because you could not have detected the collision yourself. That is why Wi-Fi has link-layer retransmission and Ethernet does not, and it is one reason Wi-Fi latency is so much more variable.

The hidden node problem makes it worse. Two laptops on opposite sides of a house can both hear the access point but not each other, so both believe the channel is free and both transmit. Carrier sensing cannot help, because neither can sense the other. The optional fix is RTS/CTS: ask the access point for permission, and the access point's "go ahead" is heard by everyone, including the node you cannot hear.

6. Switches: the box that learns

A hub was the first attempt at replacing shared cable, and it barely helped: it repeated every incoming signal out of every other port, so it was electrically the same shared wire with a box in the middle. Every device saw every frame, and collisions still happened.

A switch is fundamentally different, and the difference is that it learns.

A switch keeps a MAC address table mapping MAC addresses to physical ports. It builds this table entirely by observation, with three rules:

1. When a frame arrives on a port, record its source MAC as being reachable through that port. The sender told you where it is just by sending.
2. If the destination MAC is in the table, forward the frame out that one port only. Nobody else sees it.
3. If the destination is unknown, flood it out every port except the one it arrived on. The reply will teach you where that device is, and you will not need to flood again.

Nobody configures this. Plug a switch in and it works, and within a few frames it has learned the topology. That self-configuration is a large part of why Ethernet won.

The consequences are all improvements:

• Each port is its own collision domain. Two conversations between different pairs of devices happen simultaneously at full speed.
• Full duplex becomes possible. With a dedicated link per device, each can send and receive at once, doubling throughput and making collisions impossible.
• Traffic is more private. Your neighbour's frames do not reach your port. (Not private — a switch can be forced to flood by overflowing its table, an attack called MAC flooding — but far better than a hub.)

Broadcasts still go everywhere. A frame to ff:ff:ff:ff:ff:ff is flooded out every port by definition, because that is what broadcast means. The set of devices that receive each other's broadcasts is called a broadcast domain, and this is the concept that matters for everything that follows.

A broadcast domain cannot grow indefinitely. ARP is a broadcast; so are several discovery protocols. With ten thousand devices in one broadcast domain, every machine spends real CPU time receiving and discarding broadcasts meant for others. This is why large networks are split, and there are two ways to do it:

• A router separates broadcast domains, because a router does not forward broadcasts. Chapter 5.3.
• A VLAN (virtual LAN) splits one physical switch into several logical networks by tagging each frame with a VLAN number (IEEE 802.1Q adds four bytes to the frame for this). Devices in VLAN 10 and VLAN 20 can be plugged into the same switch and be completely unable to reach each other without a router.

VLANs are the direct ancestor of cloud networking. When Chapter 5.10 builds a virtual private cloud with separate subnets, the isolation mechanism is conceptually this: tag the traffic, and let only tagged-alike traffic mix.

One more thing a switch must handle: loops. Connect two switches with two cables for redundancy and you have created a loop. A single broadcast frame is then flooded around the loop forever, and since each switch re-floods it out every port, the frame count doubles at every hop. Within seconds the network is saturated. This is a broadcast storm, and unlike an IP packet a frame has no time-to-live field to stop it — a genuine design gap in Ethernet.

The fix is Spanning Tree Protocol: the switches talk to each other, work out a loop-free subset of the links, and disable the redundant ones until a failure makes them necessary. You buy redundancy at the cost of leaving capacity idle. Modern data centres use different approaches for exactly that reason.

What the interviewer will push on

"What is the difference between a MAC address and an IP address?" The answer that shows understanding is about scope and structure: a MAC address is flat, has no geography, and works only on one local network; an IP address is hierarchical, so a router can infer direction from it. Then add the sentence that ties them together: on a multi-hop journey the MAC addresses change at every hop while the IP addresses stay the same.

"Walk me through what happens when you ping a machine on another network." They want the ARP step. Compute whether the destination is local using the subnet mask; if not, ARP for the default gateway, not the destination; frame it to the router's MAC but with the destination's IP; the router strips the frame and builds a new one for the next hop.

"What does a switch do that a hub does not?" It learns MAC-to-port mappings from source addresses and forwards to one port instead of flooding. Consequences: separate collision domains, full duplex, better privacy. Then the limit: broadcasts still flood everywhere, which is what bounds a broadcast domain's size.

"Why is the Ethernet minimum frame 64 bytes?" So a sender is still transmitting when the collision signal returns, which is set by the cable length and the speed of signal propagation. It is the speed of light encoded in a protocol constant.

"Why can Wi-Fi not use collision detection?" A radio cannot listen while transmitting; its own signal drowns everything. Hence collision avoidance plus mandatory acknowledgements, hence link-layer retransmission, hence more variable latency. Then mention the hidden node problem and RTS/CTS.

"How would you attack a device on the same Wi-Fi network as you?" ARP spoofing — reply to ARP requests claiming to be the router, and all traffic flows through you. Then say what stops it mattering: TLS, because the attacker sees ciphertext they cannot read or alter. Naming both the attack and why it is largely defanged in practice is the complete answer.

One thing to volunteer: mention MTU and say why it matters two layers up. A 1,500-byte limit sets the TCP segment size, and a smaller MTU somewhere in the middle of a path causes fragmentation or a black hole — which is the actual cause of the classic "the connection works but large responses hang" bug. Chapter 5.3 and 5.4 develop it.

Recall

• Encodings like Manchester and 4B/5B deliberately spend capacity to guarantee signal transitions, because the receiver needs them for clock recovery — a long run of identical bits would otherwise desynchronise it.
• An Ethernet frame has a preamble (a tuning note for the clock), MAC addresses, a type field naming what comes next, a 46–1500 byte payload, and a CRC that causes corrupt frames to be silently dropped — detection here, recovery at a higher layer.
• A MAC address is flat with no geography, so it cannot scale past one network; the first three bytes are the manufacturer's OUI.
• ARP broadcasts "who has this IP" and caches the reply. It only ever asks about the local network — for anything else it resolves the router. MAC addresses change every hop; IP addresses do not. ARP has no authentication, hence ARP spoofing.
• The 64-byte minimum frame exists so a sender is still transmitting when a collision returns — the speed of light written into a constant. Wi-Fi cannot detect collisions at all (a radio cannot listen while transmitting), so it uses CSMA/CA with mandatory acknowledgements.
• A switch learns MAC-to-port mappings from source addresses and floods only when the destination is unknown. Broadcasts still reach everyone, which bounds a broadcast domain; routers and VLANs split them.
• Ethernet frames have no time-to-live, so a physical loop causes a broadcast storm; Spanning Tree disables redundant links to prevent it.

Self-test: Why does 4B/5B send five bits for every four? · What does the type field in an Ethernet frame do? · Which addresses change at each hop and which do not? · Why is the minimum frame 64 bytes? · Why does Wi-Fi acknowledge every frame when Ethernet does not? · What creates a broadcast storm, and why can Ethernet not stop one by itself?

Next: 5.3 is the layer that turns a pile of separate local networks into one internet — IP addresses, what a subnet mask is actually doing in binary, why your home address starts with 192.168, and why cloud providers now charge you for an IPv4 address.