We climb one rung up the OSI model: layer 2, the data link layer. If the physical layer delivers a "raw" bit stream, the data link layer is the one that brings it to order: it groups the bits into frames, gives them a sender and a recipient within the local network, decides who may transmit at any given moment and detects when a frame has arrived corrupted. In module 2 (lesson 02-02) you already worked with its main characters — the Ethernet frame, MAC addresses, ARP and the switch's table — so we won't repeat that detail here: we are going to look at layer 2 from the OSI model's viewpoint, understanding its services as a layer, its two internal sublayers (LLC and MAC), and adding a new piece of enormous practical importance: VLANs. This layer is your territory whenever the problem is "inside the office": between a machine and its switch, or between machines on the same local network.

1. The data link layer's role within the model
2. The four services of layer 2
3. The two sublayers: LLC and MAC
4. The switch, the layer 2 device par excellence
5. VLANs: logical networks on a single switch
6. The broadcast domain, revisited through OSI

Layer 2's contract with its neighbors is the following:

• What it receives from above (layer 3): a packet that must be delivered to the next hop within the local network — whether the final recipient (the .10 server, if it is on the same network) or the router that will carry the packet out toward another network.
• What service it offers layer 3: delivery of the packet to the correct neighboring node, with transmission errors detected and corrupt frames discarded.
• What it uses from below (layer 1): the transmission of bits over the medium, imperfections included.
• Its PDU: the frame. Its addresses: the MACs.

The key word is local. The data link layer only sees one link: a stretch between directly connected nodes (Marta's PC and its switch, the switch and the router). It knows nothing about remote networks: when Marta's ping traveled to Bilbao in 02-03, the IP packet was the same end to end, but the frame was destroyed and rebuilt at every hop. The frame is the delivery envelope for the last stretch; the packet is the letter that travels whole. This split — layer 2 local, layer 3 end to end — is one of the most important divisions in the entire OSI model.

Seen as a layer of the model, the data link offers four services. The first two will ring a bell from 02-02; we now state them with their formal names:

Turning layer 1's continuous bit stream into units with a beginning and an end: the frames. Each frame carries a start delimiter, header, payload and trailer, so the receiver knows exactly where each unit begins and ends. Without framing, the received bits would be uninterpretable — like text with no spaces or punctuation. We already broke down the exact structure of the Ethernet frame in 02-02.

Every frame carries the source and destination MAC, which allows each frame, on a medium with many nodes (all of Valencia's machines hang off the same switch), to reach only the party it should. Remember from 02-02 that the translation "I have a destination IP, I need its MAC" is done by ARP, and that you can see your machine's cache with arp -a. From the OSI perspective, ARP is the glue between layer 3's logical addressing and layer 2's physical addressing.

When several nodes share a medium, someone has to referee the transmission turns. These are the CSMA/CD (classic Ethernet with hubs) and CSMA/CA (Wi-Fi) mechanisms we saw in 02-02: listen before you speak and manage collisions. In Meridiano's modern switched Ethernet, collisions have vanished (each machine has its own dedicated cable to the switch), but on the office Wi-Fi the refereeing remains fully in force: the air is a shared medium and the access point and the laptops share out turns with CSMA/CA.

This service deserves a pause, because it ties up the previous lesson's loose end: layer 1 delivers the bits exactly as they arrive, including those corrupted by noise or attenuation. Layer 2 detects them like this:

• The sender computes a mathematical value from all the frame's bits — a CRC (cyclic redundancy check) — and writes it in the frame's trailer, in the FCS (Frame Check Sequence) field.
• The receiver redoes the same calculation over the received bits and compares it with the FCS that arrived.
• If they don't match, some bit changed along the way: the frame is silently discarded.

Conceptually, the CRC is like the check digit on a bank account number or an ID card: a value derived from the content that betrays almost any alteration. Two important nuances:

• It is detection, not correction: layer 2 throws the corrupt frame away, but neither repairs it nor requests a resend. Recovering the lost data, when needed, is the job of upper layers (TCP, layer 4, with its retransmissions — module 02-04).
• A switch's "CRC errors" counters are gold for diagnosis: a port that racks up CRC errors almost always betrays a layer 1 problem (damaged cable, dirty connector, interference). If the faulty cable in the Valencia meeting room had been almost fine instead of cut, the symptom would have been exactly that: a slow, intermittent network and CRC errors climbing on port 24.

The standard internally divides layer 2 into two sublayers. It is a classic exam detail and helps you understand the design:

The underlying idea: the MAC sublayer is different for Ethernet and for Wi-Fi (different media, different access rules), but the LLC sublayer shows layer 3 the same face in both cases. Thanks to that, IP doesn't need to know whether it rides over cable or radio: when Ana's laptop moves from her desk cable to the meeting room Wi-Fi, the MAC sublayer changes, but IP never notices. This, by the way, is where the name "MAC address" comes from: it is the MAC sublayer's address.

If the router is the emblematic layer 3 device, the switch is layer 2's. You already studied how it works in 02-02, so we just place it on the OSI map: the switch receives the frame (climbing through layers 1 and 2), reads the destination MAC, consults its MAC table (which it builds by learning the source MACs it sees on each port) and forwards the frame only through the correct port; if it doesn't know the destination, it floods it out all of them. There it stops: it looks at neither the IP nor the TCP ports — that would mean climbing to layers 3 and 4, which are none of its business.

This position at layer 2 explains its virtues over the hub we buried in the previous lesson: by understanding MAC addresses it can switch each frame only toward its destination, eliminating collisions and giving each port its full bandwidth. The Valencia Wi-Fi access point is also, essentially, a layer 2 device: a "wireless switch" that bridges the air and the cable.

In catalogs you will also see "layer 3 switches": devices that additionally know how to route between networks. Don't let them confuse you: they are a hybrid (switch + router in one box) common in large enterprises; Meridiano's is a classic layer 2 switch.

And now, this lesson's important novelty. Let's pose the problem with a real Meridiano case:

The case: Grupo Meridiano hosts client visits at the Valencia office and offers them Wi-Fi. But there is a serious problem: any device connected to the 192.168.10.0/24 network is "inside" — it can try to reach the .10 file server, see the other machines and receive every broadcast. Does management want a visitor's personal laptop sharing the same local network as the server holding client data? Certainly not.

The naive solution: buy a second switch, a second access point and cable a physically separate guest network. It works, but it doubles hardware, cabling and maintenance to serve three visits a week.

The layer 2 solution: VLANs (Virtual LANs). A VLAN lets you split one physical switch into several logical switches: each port is assigned to a VLAN, and the switch behaves as if ports in different VLANs were in separate, unconnected devices.

Key points of the concept (we stay conceptual; detailed configuration is beyond this course):

• The separation is total at layer 2: neither addressed frames nor broadcasts cross from one VLAN to another. The visitor's laptop cannot even "see" the .10 server, even though it is plugged into the same physical box.
• Each VLAN is its own logical network and normally carries its own IP range (the corporate one would stay on 192.168.10.0/24; the guest one would use another range with Internet-only access).
• If something must cross between VLANs, a layer 3 device is required (the router): moving from one VLAN to another is, for all purposes, moving from one network to another. This reinforces the OSI boundary: the switch separates (layer 2), the router connects networks (layer 3).
• When several VLANs must travel over the same cable (for example, from the switch to the access point broadcasting both the corporate and the guest Wi-Fi), the frames are marked with a tag indicating their VLAN (the 802.1Q standard); that way devices know which logical network each frame belongs to. Keep the idea of the tag; the standard's details aren't needed now.

VLANs are ubiquitous in enterprise networks: separating departments, isolating IP telephony, security cameras or guests, all on the same hardware. For Meridiano, the technical proposal reads: corporate VLAN 10 and guest VLAN 20 on the existing switch and access point, with the router controlling (and restricting) any crossing between the two.

In 02-02 we defined the broadcast domain: the set of machines that receive a frame sent to the broadcast MAC (FF:FF:FF:FF:FF:FF), such as ARP requests or DHCP discovery. Now we can state it with OSI precision:

• A switch (layer 2) does NOT separate broadcast domains: it forwards broadcasts out all its ports... in the same VLAN.
• A router (layer 3) DOES separate them: broadcasts do not cross layer 3. Valencia and Bilbao are two distinct broadcast domains; an ARP sent by Marta never reaches Bilbao.
• Each VLAN is its own broadcast domain: this is the novelty. With VLANs 10 and 20 configured, the Valencia switch contains two broadcast domains on a single box. Broadcast storms, ARPs and the guests' DHCP stay in their VLAN.

This table condenses half the module: memorize it by understanding it, because it is a guaranteed question in any certification and, more importantly, it is what tells you which box you need for each design problem.

• Thinking the frame travels end to end. No: the frame lives one hop; at each router it is decapsulated and a new one is created for the next stretch. What persists end to end is the IP packet (layer 3). Confusing this ruins any diagnostic reasoning.
• Believing the FCS corrects errors or triggers resends. It only detects and discards. If nothing retransmits higher up (UDP, for instance), that data is simply lost.
• Attributing layer 3 intelligence to the switch. A standard switch knows nothing about IPs: if a machine has the wrong subnet mask or gateway, the switch will keep happily delivering its frames; the problem lives one layer up.
• Thinking a VLAN is a "more or less" separation. The layer 2 separation is absolute: without a router in between, two VLANs do not communicate at all. That is precisely its value as a security measure.
• Forgetting that Wi-Fi is also layer 2 (and 1). The access point participates in the same broadcast domain as the cable it connects to (VLANs aside); Wi-Fi association problems are layer 1-2 problems, not IP ones.
• Tip: faced with a "slow and intermittent" local network, ask for the CRC error counters on the switch ports. It is the perfect bridge between the layer 2 diagnosis and the layer 1 cause.

Exercise 1. Assign each task to one of the four data link services (framing, physical addressing, media access control, error detection): (a) Ana's laptop waits for the Wi-Fi channel to be free before transmitting; (b) the .10 server discards a frame whose FCS doesn't add up; (c) the switch reads AA:BB:CC:11:22:33 as a frame's destination; (d) the network card locates the start delimiter to know where the frame begins.

Exercise 2. After configuring VLANs 10 (corporate) and 20 (guests) on the Valencia switch, a visitor connected to the guest Wi-Fi tries to: (a) ping the server 192.168.10.10, (b) browse the Internet, (c) get an IP via DHCP. Reason out what happens with each attempt and which device would have to step in for (a) to become possible if it were ever needed.

Exercise 3. Port 7 on the Valencia switch (Marta's) has been racking up thousands of CRC errors since yesterday, and Marta finds the network painfully slow. (a) At which OSI layer is the detection that generates those counters acting? (b) At which layer is the cause almost certainly located? (c) Propose two concrete checks. (d) Why does Marta's browsing "work but slowly" instead of failing outright? (Hint: think about which layer retransmits.)

Solution 1. (a) Media access control (CSMA/CA on Wi-Fi). (b) Error detection (FCS/CRC check). (c) Physical addressing (destination MAC for switching). (d) Framing (delimiting where the frame begins and ends).

Solution 2. (a) It fails: the ping would require the frame to cross from VLAN 20 to VLAN 10, and the layer 2 separation is total; the visitor's machine can't even resolve the server's MAC via ARP. (b) It works, provided VLAN 20 has a path to the router and the router grants Internet access: browsing doesn't require touching the corporate VLAN. (c) It works, as long as a DHCP service exists for VLAN 20 (remember that DHCP uses broadcasts and these never leave their VLAN, so the service must be present in that VLAN or the router must relay them). For (a) to be possible, the router (layer 3) would have to step in: only a layer 3 device connects VLANs, and it would allow rules to be applied (for example, permitting only one specific service).

Solution 3. (a) The detection is a layer 2 service: the frames' FCS is checked on receipt and failures are counted per port. (b) The cause is almost certainly at layer 1: a damaged cable, a defective connector, interference — something is corrupting bits on the medium. (c) Checks: swap Marta's patch cable for a known-good one; test the wall jack/fixed stretch with a cable tester or plug Marta into another wall jack and see whether the errors continue; review whether anything changed yesterday (building work, a pinched cable). (d) It works slowly because TCP (layer 4) retransmits the segments whose frames were discarded: the data gets through in the end, but every loss costs time. It is the OSI model in action: layer 2 discards, layer 4 recovers, and the user only perceives slowness.

The data link layer turns the physical layer's bit stream into orderly communication within the local network: it frames the data, addresses it with MACs, referees access to the medium and detects errors with the FCS, discarding what's corrupt and leaving recovery to the upper layers. Inside, it splits into LLC (a uniform face toward layer 3) and MAC (the specifics of each medium). Its star device is the switch, and with VLANs you learned to carve one physical switch into several logical networks — each its own broadcast domain — solving the isolation of Meridiano's guests without buying hardware. But layer 2 has an impassable border: it only knows its own local network. For Marta's ping to reach Bilbao, for VLANs 10 and 20 to talk, for paths to be chosen between networks, we must climb one step: logical addresses, routers and routing. That is the network layer, and it is the next lesson.