In the previous lesson we saw the protocol stack from a bird's-eye view; now we land on the family that solves the most basic and most local problem: how two machines on the same local network segment communicate — connected to the same switch, the same Wi-Fi, "one cable away". When Marta's PC saves a document on the Valencia file server, the data doesn't go out to the Internet or cross the VPN: it travels through the office switch, and the ones who make that trip possible are the data link protocols. In this lesson we will study Ethernet (the king of the cable), Wi-Fi/802.11 (its wireless counterpart), MAC addresses in action, ARP (the indispensable glue between MAC and IP addresses) and the role of the switch, plus two concepts that explain why modern networks perform so well: collision domains and broadcast domains.

1. The data link's mission: connecting neighbors
2. Ethernet: the wired network protocol
3. Inside the Ethernet frame
4. CSMA/CD: the story of collisions
5. Wi-Fi (802.11): when the medium is the air
6. ARP: the glue between IP and MAC
7. Inside the switch: the MAC address table
8. Collision domains and broadcast domains

Data link protocols have a deliberately limited mission: delivering data between devices connected to the same local medium, the same network "neighborhood". Their reach ends where the router begins: carrying data between different networks is the job of the network protocols, which we cover in lesson 02-03.

To fulfill that mission they take care of three tasks:

• Identifying the neighbors: every network card has a MAC address (we met it informally in lesson 01-01): 48 bits, written as 6 hexadecimal pairs, for example A4:5E:60:D2:1B:07. It comes burned in at the factory, and the first 3 pairs identify the manufacturer.
• Packaging the data into frames: the frame is the data link's data unit (remember the encapsulation from 02-01: the frame is the outermost envelope).
• Regulating access to the medium: if several machines share the same medium (the same old-style cable, or the air in Wi-Fi), a rule is needed to decide who transmits and when, or the messages would crash into each other.

A useful comparison: if the network protocols (02-03) are the postal service between cities, the link protocols are delivery within the neighborhood: they know every doorway (MAC address) and deliver door to door, but they know nothing of the world beyond the neighborhood.

Ethernet (IEEE standard 802.3) has been the dominant link protocol on wired networks for over 40 years. Every fixed workstation at Meridiano, the file server, the printers and the switch-router links all run on Ethernet. It has outlived every fad because it has kept multiplying its speed while preserving the same frame format:

The fact that the frame format has never changed is a magnificent design lesson: Meridiano moved its workstations from 100 Mbps to 1 Gbps by replacing switches and network cards, without touching a single line of software or any other protocol. The substitutability we talked about in 02-01, in action.

Let's apply the syntax analysis we learned in the previous lesson. This is the (simplified) structure of an Ethernet frame:

Each field has well-defined semantics:

• The destination MAC comes first for a practical reason: that way the receiver (and the switch) can decide as early as possible whether the frame concerns it, without reading the whole thing.
• The Type field is the piece that hooks this lesson to the next one: it tells the receiver which upper protocol to hand the contents to after decapsulating (almost always, IP).
• The FCS (Frame Check Sequence) is a value computed from every bit in the frame. The receiver redoes the calculation on arrival: if it doesn't match, the frame got damaged along the way (interference, a faulty cable) and it is silently discarded. Ethernet detects errors but does not resend: recovery, if needed, is the transport's job (lesson 02-04).
• There is also a broadcast MAC: FF:FF:FF:FF:FF:FF. A frame sent to that address is processed by every machine on the segment. We will put it to use in a moment with ARP.

An example with Meridiano data: when Marta's PC (A4:5E:60:D2:1B:07) sends data to the file server (00:1B:44:11:3A:B7), the frame goes out like this:

In the original Ethernet, every machine shared a single coaxial cable (the bus topology we saw in 01-03): if two transmitted at once, their electrical signals mixed and both frames were ruined. That is called a collision, and Ethernet managed it with the CSMA/CD method (Carrier Sense Multiple Access with Collision Detection):

1. Listen before you speak (Carrier Sense): if the cable is busy, wait.
2. Anyone may speak (Multiple Access): there are no assigned turns.
3. Detect collisions (Collision Detection): if, while transmitting, a machine detects that another is transmitting too, both stop, wait a random amount of time (so they don't crash again) and retry.

It is exactly what we do in a meeting with no moderator: wait for silence, speak, and if two people start at once, both go quiet and one tries again a moment later.

Why do we tell this in the past tense? Because on a modern network like Meridiano's there are no collisions anymore: each machine has its own dedicated cable to the switch, and the links are full-duplex (they can send and receive at the same time). CSMA/CD is still in the standard, but dormant. Even so, it is worth knowing for two reasons: it explains many terms still in use (we will see this with collision domains) and, above all, its cousin CSMA/CA is alive and well in Wi-Fi.

Wi-Fi (the IEEE 802.11 family of standards) is the link protocol of wireless networks: it is what the Valencia laptops and phones use when they connect to the office access point. Conceptually it does the same thing as Ethernet (frames, MAC addresses), but the air is a far more hostile medium than a cable, and that forces some important differences:

The star difference is CSMA/CA (Collision Avoidance — avoiding instead of detecting). Over the air, a machine cannot detect a collision while transmitting (its own signal "deafens" it: it's like trying to hear a whisper while you're shouting). Since it can't detect them, it devotes itself to avoiding them:

1. It listens to the channel; if it's busy, it waits.
2. When the channel frees up, it also waits an additional random time before transmitting (that way, if several machines were waiting, they don't all start at once).
3. After transmitting, it waits for an ACK from the receiver. If it doesn't arrive, it assumes there was a collision or interference and resends.

A practical consequence every professional must be able to explain: Wi-Fi is a shared medium. The 8 laptops connected to the Valencia access point take turns sharing the channel; the more machines (and the more interference), the lower the throughput per machine. That is why Meridiano's file server and fixed workstations run on cable: for heavy, constant traffic, the cable remains irreplaceable.

Now, the piece that ties everything together. Applications and network protocols work with IP addresses (logical, configurable), but we have just seen that frames on the local segment are delivered by MAC address (physical, factory-set). When Marta's PC (192.168.10.21) wants to send a packet to the file server (192.168.10.10), it knows its IP... but to build the Ethernet frame it needs its MAC. How does it find out?

With ARP (Address Resolution Protocol), a tiny, ubiquitous protocol that works in shouts and whispers:

• The question (ARP request) goes out as a broadcast because nobody knows who the recipient is: every machine on the segment receives it.
• The answer (ARP reply) goes straight back to whoever asked.
• The result is stored in the ARP table (or ARP cache) for a few minutes, so the PC doesn't have to shout the question for every frame.

You can look at your own machine's ARP table right now. On Windows (on Linux, ip neigh shows the equivalent):

Output on Marta's PC:

Every dynamic line is a recent ARP resolution: the evidence of who that PC has talked to on its local network in the last few minutes. Notice that the router shows up (192.168.10.1): when Marta talks to Bilbao or to the Internet, her PC does not resolve the MAC of the final destination (it's on another network — ARP doesn't reach that far), but the router's MAC, its way out. That nuance — who the frame is handed to when the destination is elsewhere — is precisely the border with the next lesson.

In module 1 we said the switch "sends each frame only to its recipient". Now we can explain how it pulls that off: it maintains a MAC address table that maps each MAC to the physical port it is connected to, and it builds that table all by itself, learning from the frames that pass through it:

1. It learns from the source: when a frame arrives on port 3 with source MAC A4:5E:60:D2:1B:07, the switch notes: "that MAC lives on port 3".
2. It decides by the destination: it looks up the destination MAC in its table. If it knows it, it forwards the frame out that port only. If it doesn't know it (yet), it forwards it out every port except the incoming one (flooding), just as a hub would; the recipient's reply will let it learn where that machine lives.
3. Broadcasts go to everyone: a frame addressed to FF:FF:FF:FF:FF:FF (like an ARP request) is always forwarded out every port.

The Valencia switch's table after a few minutes of activity:

Notice that the switch knows nothing about IP addresses: it lives entirely in the data link world. That is precisely why it is so fast: looking up a MAC in a table is a trivial operation it performs at wire speed.

Two pieces of professional vocabulary that sum up everything above:

• Collision domain: the set of machines whose transmissions can collide with each other. In the era of the bus and of hubs, the whole network was a single collision domain (hence CSMA/CD). Each switch port is its own collision domain, and with full-duplex, collisions vanish from the cable. In Wi-Fi, on the other hand, every machine on the same access point shares a collision domain: that is why CSMA/CA exists.
• Broadcast domain: the set of machines that receive broadcast frames (like ARP requests). The switch does not limit it (it forwards broadcasts to everyone): the entire Valencia LAN is a single broadcast domain, and Bilbao's is another. The boundary of the broadcast domain is the router: Valencia's broadcasts never cross over to Bilbao, not even through the VPN.

This table explains why Marta's question "who has 192.168.10.10?" is heard by all of Valencia but by nobody in Bilbao — and why talking to Bilbao takes something more than data link.

• Believing the final destination's MAC travels in the frame when the destination is on another network. It doesn't: the frame always carries the MAC of the next local hop (the router, if the destination is elsewhere). MACs never leave the segment; IPs do travel end to end. Confusing this is the number one beginner's mistake.
• Thinking the switch "knows" which machines are connected. It only knows MAC-port pairs it has learned by watching traffic, and it forgets them after a few minutes of inactivity. If a machine has been silent for hours, its first incoming frame will be flooded out every port.
• Blaming the cable when the Wi-Fi is slow. Wi-Fi is a shared medium with CSMA/CA: more users and more interference mean more waiting and more retries. Before opening a ticket, ask how many devices hang off the same access point.
• Ignoring the ARP table when troubleshooting. If a PC can't reach the server while on the same network, arp -a is one of the first useful checks: if the server's entry is missing (or shows as incomplete), ARP resolution is failing and the problem is local (cable, switch, or the server itself is down).
• Tip: memorize the rule pair "switch = separates collisions, router = separates broadcasts". It shows up in certification exams, in interviews and, above all, in real network design.

Exercise 1. Marta's PC (192.168.10.21) has just booted (empty ARP table) and wants to print on the Valencia network printer (192.168.10.40). Describe step by step which link protocols get involved and which frames are sent before the first frame carrying print data goes out, indicating which travel as broadcast and which as unicast.

Exercise 2. In this lesson's Valencia switch MAC table, the frame source=a4:5e:60:d2:1b:07, destination=00:1b:44:11:3a:b7 arrives on port 3. Out of which ports does the switch forward it? What if the destination were ff:ff:ff:ff:ff:ff? And what if it were the MAC b2:11:70:0d:55:e1, which is not in the table?

Exercise 3. A colleague proposes saving on cabling on the new Valencia floor by connecting the 10 workstations over Wi-Fi — "come on, the Wi-Fi at my place works perfectly". Give two technical arguments from this lesson to defend cable for fixed workstations.

Solution 1:

1. The PC checks that 192.168.10.40 is on its own local network, so it needs its MAC.
2. It looks in its ARP table: empty. It sends a broadcast ARP request (FF:FF:FF:FF:FF:FF): "who has 192.168.10.40?". The switch forwards it out every port; the server, the router, the AP and the printer all receive it.
3. Only the printer answers, with a unicast ARP reply straight to Marta's PC: "that's me, my MAC is f8:d0:27:33:9c:02".
4. The PC stores the IP-MAC pair in its ARP table and can now build the Ethernet data frame: destination=f8:d0:27:33:9c:02, source=a4:5e:60:d2:1b:07, type=0x0800, [print data], FCS, which the switch delivers out port 5 only.

Solution 2:

• Destination 00:1b:44:11:3a:b7: it is in the table (port 2) → the switch forwards it out port 2 only. Along the way it refreshes what it learned about the source MAC on port 3.
• Destination ff:ff:ff:ff:ff:ff (broadcast): it forwards it out every port except port 3 (the incoming one).
• Destination b2:11:70:0d:55:e1 (unknown): it floods, every port except port 3, just like the broadcast; when that machine replies, the switch will learn its port and subsequent frames will be delivered directly.

Solution 3: First, Wi-Fi is a shared medium with CSMA/CA: the 10 workstations would take turns on the channel, with random waits and a per-frame ACK, and per-seat throughput would drop as soon as several people worked against the file server at once (exactly the traffic pattern of a consultancy). Second, cable delivers stable, collision-free performance (a dedicated full-duplex 1 Gbps link per seat thanks to the switch), immune to interference and walls. The Wi-Fi at home "works perfectly" because 2 or 3 devices use it with light traffic; 10 professional workstations working simultaneously are a different scenario. Wi-Fi stays for laptops and phones, just as Meridiano already does.

We now rule the neighborhood. Data link protocols deliver frames between machines on the same segment: Ethernet on the cable (with its frame of destination MAC, source MAC, type, data and FCS, and its historic CSMA/CD now retired by full-duplex switches) and Wi-Fi/802.11 in the air (where CSMA/CA still referees a shared medium that forces every frame to be acknowledged). We have seen the glue that binds the logical world to the physical one — ARP, which translates IP to MAC by asking at the top of its voice and answering in a whisper, with its table viewable via arp -a — and we have opened up the switch to discover its MAC address table and the two borders that bound this world: the collision domain (which the switch chops up) and the broadcast domain (which only the router stops). And there lies the limit: when Marta saves a file on the Valencia server, data link is enough; but when she sends something to Bilbao, her frame dies at the router and someone has to take charge of the journey between networks. That someone is the IP protocol and its retinue, the stars of the next lesson: Network Protocols.