Unit 3: Data Link Layer (Layer 2)

What is the data link layer?

The Data Link Layer is responsible for node-to-node delivery of data on the same local network. It takes the raw bits from the Physical Layer and organises them into frames so that they can be reliably exchanged between two directly connected devices — like your laptop and the Wi-Fi router.

Unit of data: frame

Sub-layers

The data link layer is split into two sub-layers:

• LLC (Logical Link Control) — handles flow control and error checking.
• MAC (Media Access Control) — manages how devices share the same medium and uses MAC addresses to identify them.

Responsibilities

• Framing — packages bits into frames with headers, payload, and trailer.
• Physical (MAC) addressing — every NIC has a unique 48-bit MAC address like AA:BB:CC:11:22:33.
• Error detection — uses a CRC (Cyclic Redundancy Check) to detect corrupted frames.
• Flow control — prevents a fast sender from overwhelming a slow receiver.
• Access control — decides which device gets to transmit on a shared medium (e.g. CSMA/CD on legacy Ethernet, CSMA/CA on Wi-Fi).

Protocols and devices

• Ethernet (IEEE 802.3) — wired LAN standard.
• Wi-Fi (IEEE 802.11) — wireless LAN standard.
• PPP (Point-to-Point Protocol) — used over serial links and some VPNs.
• ARP (Address Resolution Protocol) — maps an IP to a MAC address (sits between L2/L3).
• Switches and bridges — devices that forward frames based on MAC addresses.

Example — a simple Ethernet frame

A standard Ethernet frame looks like this:

+---------------+---------------+--------+----------+-----+
| Dest MAC (6B) | Src MAC  (6B) | Type   | Payload  | CRC |
+---------------+---------------+--------+----------+-----+

When your laptop sends data to the router:

1. The IP packet is wrapped in an Ethernet frame.
2. Source MAC = laptop’s NIC.
3. Destination MAC = router’s NIC (looked up via ARP).
4. The CRC at the end lets the router detect if the frame was corrupted.
5. The router accepts the frame and passes the payload up to Layer 3.

Real-world scenarios

AWS VPC and tenant isolation

In AWS, every customer’s VPC (Virtual Private Cloud) is logically isolated even though many customers share the same physical switches. AWS achieves this by using its own custom data-plane protocol on top of Ethernet, effectively giving each VPC its own virtual Layer 2 segment. This is why your EC2 instances cannot see another customer’s traffic.

Cisco and Arista in hyperscale data centers

Google, Microsoft Azure, and Meta run massive data centers built on Layer 2 / Layer 3 switches from vendors like Arista and Cisco, plus their own custom hardware. These switches handle millions of frames per second, learning MAC addresses and forwarding traffic between racks at line rate.

VLANs in enterprise networks

Companies like banks and universities use VLANs (Virtual LANs) — a Layer 2 technology — to separate departments (finance, HR, students, guests) on the same physical switches without buying separate hardware. Each VLAN is tagged with an ID (802.1Q) in the Ethernet frame.

Wi-Fi roaming in airports and offices

When you walk from one end of an airport to another with your phone on Wi-Fi, you seamlessly switch between access points. That handover happens at the data link layer — each AP advertises its MAC and your phone re-associates without dropping the connection.

Common Layer 2 problems

• Duplicate MAC addresses on the same network.
• Loops in the switch topology (mitigated by Spanning Tree Protocol).
• Wrong VLAN tagging on a switch port.
• ARP cache poisoning (a security issue).
• Frame collisions on legacy hub-based networks.