Network: Part 4. Data Link Layer

October 26, 2026 • 19 min read • Network • #Network • 👁 14

Introduction

The data link layer (Data Link Layer, L2) is the second level of the OSI model, which turns the "raw" physical channel into a reliable channel for transmitting frames between neighboring nodes. If the physical level operates with bits, the data link level works with frames. This is one of the important levels of network architecture, because it is precisely here that the real "network magic" begins — structuring the chaotic stream of bits into meaningful blocks of data with addressing, error control, and medium access management.
In a typical data transmission, the path looks as follows: HTTP → TCP → IP → Ethernet (data link level). At the data link level, the IP packet is packed into an Ethernet frame with the addition of service fields such as MAC addresses and the CRC checksum.

The data link level solves four fundamental tasks.

Providing services to the network level

The data link level can provide three types of service to the network level:

  1. Unacknowledged (unreliable) — frames are simply sent without delivery verification. Example: classic Ethernet.
  2. Acknowledged (reliable) — each frame is confirmed with an ACK.
  3. Connection-oriented — a handshake is performed before transmission, then data exchange takes place.

In the modern internet, an unreliable data link level is most often used, and reliability is provided at a higher level by the TCP protocol.

Framing

The physical level represents data as a continuous stream of bits. The task of the data link level is to determine where each frame begins and where it ends. Without solving this problem it is impossible to correctly interpret packets.
There are several approaches to framing:

Length counting

A data length field is included in the frame header. Drawback: an error in this field makes it impossible to correctly restore the boundaries of all subsequent frames.

Special flags (frame delimiters)

Special delimiter bytes (flags) are used to mark the beginning and end of a frame. Example: the HDLC protocol.

Byte stuffing

If a delimiter byte (flag) occurs inside the data, it is escaped with a special control character (ESC). The receiver, upon detecting ESC, interprets the next byte as data, not as a separator.

Bit stuffing

Used at the bit level. After N consecutive ones, a zero bit is inserted. The receiver removes the inserted bits, restoring the original stream. This avoids false frame boundaries and makes the protocol independent of the data content.

Error detection and correction

The physical transmission medium (cable, radio air) is subject to noise, interference, and attenuation, which inevitably leads to errors.

Error detection

Parity bit — the simplest method, but it has low reliability.

CRC (Cyclic Redundancy Check) — the main method of error detection in real networks. The data is treated as a polynomial over the field GF(2), where the bits act as coefficients. The CRC process includes the following steps:

  1. r zeros are appended to the data D (r is the degree of the generator polynomial G).
  2. Division by the generator polynomial G is performed.
  3. The remainder of the division is the CRC code.

On the receiving side, the received data is divided by the same polynomial G. If the remainder is zero, then with high probability there are no errors.
Ethernet uses CRC-32 with the polynomial:

x32+x26+x23+x22+x16+x12+x11+x10+x8+x7+x5+x4+x2+x+1

CRC-32 provides very high reliability of error detection, including single errors, burst errors, and many combinations of multiple errors.

Error correction

FEC (Forward Error Correction) — a method in which redundancy is added to the data, allowing errors to be corrected without retransmission. Used in satellite and mobile communication.

Hamming code — allows not only detecting but also finding the position of an error. Check bits are placed among the data bits in such a way as to check various combinations of positions. At reception, a "syndrome" is computed, pointing to the specific bit with the error. The basic version corrects only a single error; to correct multiple errors, more complex codes are used, such as Reed-Solomon codes.

Interleaving — a method of fighting burst errors. The data is shuffled before transmission (for example, instead of A B C D / E F G H, A E B F C G D H is transmitted). A burst error turns into a set of single errors, which are easier to correct. Used in Wi-Fi, mobile, and satellite networks.

Flow Control

The problem arises when the sender works faster than the receiver. Two main approaches are used to solve it:

  • Stop-and-Wait — the sender transmits one frame and waits for an acknowledgment (ACK). Simple to implement, but low efficiency.
  • Sliding Window — the sender can transmit several frames in a row without waiting for an ACK for each. This significantly increases the efficiency of channel usage.

Reliable transmission: ARQ

ARQ (Automatic Repeat reQuest) is a mechanism for automatically requesting retransmission in case a frame is lost.

Stop-and-Wait ARQ

A simple algorithm: sent a frame → wait for ACK → on timeout, repeat. The channel is idle most of the time.

Go-Back-N

The sender can transmit N frames in a row. When an error or loss of a frame is detected, all frames are retransmitted starting from the lost one. Example: frames 1 2 3 4 5 were sent, an error in frame 3 → retransmission of 3 4 5.

Selective Repeat

Only the lost frames are retransmitted. Requires buffering on the receiver's side and more complex logic, but provides higher efficiency compared to Go-Back-N.

Increasing transmission efficiency

Waiting for ACK reduces the efficiency of channel usage. The key metric:

Utilization≈Transmission Time / Transmission Time + RTT

For Stop-and-Wait the efficiency is:

Efficiency=Tt / Tt + 2Tp = 1 / 1 + 2a

where Tt is the frame transmission time, Tp is the signal propagation time, a=Tp / Tt.

When Tp≫Tt (for example, in satellite channels), the efficiency tends to zero.

Sliding Window solves this problem. With a window size W:

Efficiency = min(1, W / 1 + 2a)

To fully load the channel, the following is required:

W ≥ 1 + 2a

This rule is used in TCP as BDP (Bandwidth-Delay Product).

Sequence Numbers and limitations

Sequence numbers have a finite size (for example, k bits): 0 ... 2k - 1. If the numbers cycle too quickly, the receiver may confuse a new frame with an old duplicate.
Correctness conditions:

  • For Go-Back-N: W ≤ 2k − 1
  • For Selective Repeat: W ≤ 2k − 1

For Selective Repeat the condition is stricter, since the receiver accepts frames out of order and stores them in a buffer, which increases the risk of confusion.

Timers and retransmission ambiguity

When an ACK is lost, the sender performs a retransmission. The receiver may get either the original or the repeat. Sequence numbers allow the receiver to discard duplicates, but the ACK is still sent. This is a fundamental principle of reliable transmission.

Piggybacking

With bidirectional transmission, data and ACK can be combined in one frame, which reduces the number of frames and service overhead. Drawback: a delay of the ACK is possible while waiting for data.

Cumulative and selective ACKs

Cumulative ACKs (Go-Back-N) — ACK = 5 means that all frames up to 5 have been received.
Selective ACKs (SACK) (Selective Repeat) — allow specifying exactly which frames were received (for example, ACK: 1, 2, 4, 5 → frame 3 was lost). This mechanism transferred directly into TCP SACK.

The MAC sublayer (Media Access Control)

The MAC sublayer solves the key problem: how multiple devices share one transmission channel.

ALOHA

A random access protocol: a device sends data whenever it wants; upon a collision it performs a retransmission.

Pure ALOHA: throughput S=Ge^(−20), maximum ≈ 18%.
Slotted ALOHA: S = Ge^{-G}, maximum ≈ 37%.

Random access is fundamentally inefficient compared to deterministic methods.

CSMA/CD (Ethernet)

Carrier Sense Multiple Access with Collision Detection — the protocol used in classic Ethernet.
Algorithm:

  1. Listening to the channel.
  2. If the channel is free — transmission.
  3. During transmission, collision control.
  4. Upon detecting a collision — immediate termination of transmission, waiting a random time (exponential backoff), and retry.

Exponential backoff: after each collision, the range of the random delay increases, which reduces the probability of repeated collisions.

The minimum Ethernet frame size

In CSMA/CD it is necessary to detect a collision during transmission. The transmission of a frame must last longer than 2x the signal propagation time. Therefore the minimum Ethernet frame size is 64 bytes. If the frame is shorter, a collision may occur after the transmission has ended, and it will be impossible to detect. That is exactly why the data field must contain at least 46 bytes (14 bytes of header + 46 bytes of data + 4 bytes of CRC = 64 bytes).

CSMA/CA (Wi-Fi)

Collision Avoidance instead of Detection. In wireless networks it is impossible to listen and transmit simultaneously (due to radio frequency limitations). Algorithm: listening to the channel → waiting a random time → transmission → waiting for an ACK from the receiver. The ACK replaces collision detection.

The Hidden Terminal Problem

A classic Wi-Fi problem: stations A and C do not hear each other, but both hear station B. A and C may simultaneously transmit data to B, causing a collision.
Solution: the RTS/CTS mechanism (Request to Send / Clear to Send):

  1. A → RTS (request to send).
  2. B → CTS (clear to send).
  3. A transmits the data.

All stations that hear the CTS "fall silent," preventing collisions.

Deterministic vs random access

Deterministic access (TDMA, FDMA, CDMA) — it is known in advance who transmits and when. Provides predictability, but is less flexible.
Random access (Ethernet) — whoever gets there first is the one who sent. Provides flexibility, but is less predictable.
TDMA (Time Division Multiple Access) — division by time.
FDMA (Frequency Division Multiple Access) — division by frequency.
CDMA (Code Division Multiple Access) — division by codes.

The Ethernet frame format

The modern Ethernet frame (IEEE 802.3) has the following structure:

Field Size Purpose
Preamble 7 bytes Synchronization
SFD 1 byte Start of frame (the sequence 10101011)
Destination MAC 6 bytes MAC address of the receiver
Source MAC 6 bytes MAC address of the sender
Type / Length 2 bytes Protocol type (for example, IP) or data length
Data 46–1500 bytes Payload
CRC (FCS) 4 bytes Checksum

The minimum frame size is 64 bytes, the maximum is 1518 bytes (without a VLAN tag).

Features of Ethernet

  • Uses MAC addresses.
  • Works without acknowledgments (unreliable).
  • Reliability is provided at higher levels (TCP).

Ethernet is an unreliable but fast data link protocol.

Modern Ethernet: abandoning CSMA/CD

In modern networks, Ethernet operates in full-duplex mode through switches. Each switch port represents a separate channel, so there is no shared medium, and collisions are completely excluded. CSMA/CD is not used in such conditions.
To date, Ethernet standards have reached speeds of 400 Gbit/s and 800 Gbit/s (IEEE 802.3df-2024).

Wi-Fi (IEEE 802.11)

Wi-Fi differs fundamentally from wired Ethernet:

Characteristic Ethernet Wi-Fi
Medium Wired Wireless
Collision detection Yes (CSMA/CD) No (CSMA/CA)
Half-duplex/Full-duplex Full-duplex (modern) Half-duplex

Wi-Fi is more complex than Ethernet for a number of reasons:

  • The impossibility of simultaneous transmission and reception.
  • Interference and channel overlap.
  • The hidden terminal problem.
  • Variable signal strength.

Therefore Wi-Fi uses CSMA/CA, an ACK for every frame, RTS/CTS, and transmission rate adaptation.

Rate Adaptation

The transmission rate in Wi-Fi changes dynamically depending on the quality of the signal: with a good signal the rate is high; when it deteriorates — it decreases. This is a compromise between throughput and reliability.

Wi-Fi 7 (IEEE 802.11be)

The newest standard, Wi-Fi 7 (802.11be), offers the following improvements:

  • Channels up to 320 MHz wide (twice as much as in Wi-Fi 6).
  • Modulation up to 4096-QAM.
  • Up to 16 spatial streams.
  • Multi-Link Operation (MLO).
  • Maximum theoretical speed up to 46 Gbit/s.

L2 devices

Repeater — amplifies the signal, working at the physical level.
Hub — broadcasts the received signals to all ports. Works at the physical level.
Bridge — filters traffic by MAC addresses, working at the data link level.
Switch — an "intelligent bridge"; stores a table of MAC addresses and ports, and makes the decision about forwarding frames based on the destination MAC address.

The internal logic of a switch

A switch stores a MAC table mapping MAC addresses to ports. The operating algorithm:

  1. Receiving a frame.
  2. Checking the destination MAC address.
  3. If the address is known — sending to the corresponding port.
  4. If the address is unknown — broadcast sending (flood) to all ports.

The switch learns automatically by analyzing the source MAC addresses of incoming frames. This makes the network self-organizing.
The architecture of a switch includes input ports, output ports, and a switching fabric.

Switching problems

Head-of-Line Blocking — if one output port is busy, frames waiting for this port block frames destined for other ports. Solution: output buffering and crossbar switching.
Broadcast Storm — broadcast frames (MAC FF:FF:FF:FF:FF:FF) are sent to all ports. When there are loops in the topology, infinite multiplication of frames arises, overloading the network and bringing down the L2 segment. This is one of the most dangerous errors in networks.

Spanning Tree Protocol (STP)

STP solves the problem of loops in networks with redundant connections. Algorithm:

  1. Election of the root bridge (Root Bridge) by the minimum Bridge ID.
  2. For each switch, choosing the path to the root with the minimum cost.
  3. Blocking redundant ports.

STP port states: blocking, listening, learning, forwarding. This is a distributed algorithm without central control.

VLAN (Virtual LAN)

VLAN allows logically dividing one physical network into several isolated segments. A VLAN tag (802.1Q) is added to the Ethernet frame:

[MAC][MAC][VLAN TAG][TYPE][DATA]

The VLAN tag contains a 12-bit VLAN ID and a 3-bit priority field (PCP — Priority Code Point). Priorities range from 0 (lowest) to 7 (highest), which allows implementing QoS at the data link level.
VLAN provides traffic isolation, security, and network segmentation. Example: VLAN 10 — development, VLAN 20 — accounting.

Not all data is equally important: VoIP is sensitive to delay, file transfers are not. QoS at L2 is implemented through priority queues, scheduling, and priority frames (802.1p). This affects latency and latency variation (jitter).

MAC addresses

Definition and format

A MAC address (Media Access Control address) is a unique identifier of a network interface (NIC), used at the data link level. It is usually 48 bits long and is written as hexadecimal groups: 00:1A:2B:3C:4D:5E.

Structure:

  • The first 24 bits are the OUI (Organizationally Unique Identifier), identifying the manufacturer.
  • The second 24 bits are a unique number assigned by the manufacturer.

Purpose and scope

A MAC address solves the strictly local task of delivery between neighboring nodes in one network segment. It is used inside the Ethernet frame:

[Dest MAC][Src MAC][Data]

When transmitting data:
1. An IP packet is formed (L3).
2. It is packed into an Ethernet frame (L2).
3. The MAC addresses of the sender and receiver are added to the frame.

MAC vs IP

Characteristic MAC IP
Level L2 L3
Scope Local network Global
Purpose Frame delivery Routing
Changes At every hop Stays the same

A critical point: the MAC address changes at every network transition, whereas the IP address remains unchanged throughout the entire path. For example, when transmitting from a client to a server through a router, a new MAC address is used at each step, but the same IP address.

Special MAC addresses

  • Broadcast: FF:FF:FF:FF:FF:FF — sent to all devices in the segment.
  • Multicast: sent to a group of devices.
  • Unicast: sent to a specific device.

ARP (Address Resolution Protocol)

ARP links IP addresses (L3) with MAC addresses (L2). The process:

  1. A broadcast request: "Who has IP X?"
  2. The device with this IP responds: "That's me, here is my MAC."
  3. The entry is saved in the ARP table.

Without ARP it is impossible to send a packet, since the data link level requires knowledge of the MAC address of the next hop.

L2 security

The data link level is vulnerable to a number of attacks:

MAC flooding — overflowing the switch's MAC table, causing it to operate in hub mode (broadcasting to all ports).
ARP spoofing — substitution of the MAC address in ARP responses, allowing an attacker to intercept traffic.

Protection methods:

  • Port Security — limiting the number of MAC addresses on a port.
  • Dynamic ARP Inspection (DAI) — checking ARP packets for compliance.
  • VLAN filtering — restricting inter-VLAN traffic.
  • Gateway-controlled ARP (GCA).

VLAN hopping — an attack that allows moving between VLANs.

LLC is a sublayer of the data link level that provides the interface to the network level and multiplexing of protocols. Ethernet by itself does not know which protocol is inside the frame (IP, ARP, etc.). LLC helps distinguish these protocols.

A bit-oriented protocol using bit stuffing. Supports reliable transmission and flow control. Frame types:

  • I-frame (data).
  • S-frame (service).
  • U-frame (control).

PPP (Point-to-Point Protocol)

Used in direct connections (modem, VPN tunnels). Features:
- Framing (as in HDLC).
- Authentication (PAP, CHAP).
- Multi-protocol support.

PPP is the analog of Ethernet for point-to-point connections.

The network card (Network Interface Card, NIC) is a device that implements the data link level and partly the physical level in hardware.

The transmit path

  1. Receiving data from the OS — the driver passes the payload (for example, an IP packet) and sometimes an already prepared L2 header.
  2. Forming the frame — the NIC adds the MAC addresses of the sender and receiver, and the EtherType.
  3. CRC — computed in hardware and appended to the end of the frame.
  4. Buffering — the frame is placed into the TX buffer.
  5. Medium access (MAC) — depending on the technology (CSMA/CD for old Ethernet, CSMA/CA for Wi-Fi, or simply sending in full-duplex mode).
  6. Passing to the physical level — the frame is converted into a bit stream and a signal.

The receive path

  1. Receiving the signal — conversion into bits.
  2. Assembling the frame — determining the boundaries (preamble, SFD).
  3. CRC check — in case of an error the frame is discarded.
  4. MAC filtering — the NIC checks whether the destination MAC matches its own MAC, or whether it is a broadcast/multicast. If not — the frame is discarded at the hardware level; the CPU does not even learn about it.
  5. Passing to the OS — the data is placed into the RX buffer, an interrupt is generated (or polling is used), and the driver passes the data to the network stack.

The internal architecture of the NIC

[ Host (CPU) ]
        ↓
[ Driver ]
        ↓
[ NIC ]
   ├── MAC unit
   ├── PHY unit
   ├── Buffers (TX/RX)
   ├── DMA engine

MAC unit — the key part implementing the data link level in hardware: framing, MAC addresses, CRC, filtering, flow control.
PHY (Physical Layer) — responsible for signal encoding, voltage/radio signal, synchronization.
Buffers (TX/RX) — queues for sending and receiving. The NIC works asynchronously relative to the CPU.
DMA (Direct Memory Access) — allows the NIC to read and write memory without CPU involvement, which is critical for performance. Without DMA the CPU is forced to copy data manually; with DMA the NIC itself places the data into RAM.
Interrupt / Polling — the NIC can generate an interrupt when data is present, or the CPU can poll the NIC. Modern systems use hybrid approaches (NAPI in Linux).

Offloading (unloading the CPU)

Modern NICs perform tasks beyond the scope of L2:

  • Checksum offload — the NIC computes checksums for TCP/IP.
  • TSO (TCP Segmentation Offload) — the NIC itself breaks large data into MTU-sized segments.
  • LRO (Large Receive Offload) — combining several incoming segments of one stream.

These mechanisms significantly reduce the load on the CPU and increase throughput.

  1. Speed — 1–100 Gbit/s; the CPU would not cope with such a load.
  2. Parallelism — the NIC works independently of the CPU.
  3. Reducing the load on the CPU — freeing resources for application tasks.

A network card is not just an "adapter," but a full-fledged data link level processor that forms frames, checks for errors, filters traffic, and manages transmission.

The data link level can provide three types of service:

  1. Unacknowledged connectionless service — no connection, no acknowledgments. Example: Ethernet.
  2. Acknowledged connectionless service — no connection, but with ACK. Used in noisy (wireless) channels.
  3. Acknowledged connection-oriented service — connection establishment, guaranteed delivery.

The data link level can be either reliable or unreliable — this is a design choice.

Classification of errors

  • Single-bit errors — one bit is corrupted.
  • Burst errors — several bits in a row are corrupted.

CRC detects burst errors well; the Hamming code detects single errors. Therefore, combinations of methods are often used in practice.

Bandwidth-Delay Product

The product of bandwidth and delay determines the "volume of the channel" — how much data can be in flight. This is directly related to the size of the sliding window and the efficiency of the protocol.

Final generalization

The data link level solves three fundamental problems:

  1. Where are the boundaries of the data? → Framing.
  2. What to do with errors? → CRC + ARQ.
  3. How to share the channel? → MAC protocols.

The full set of functions of the data link level includes:

  • Data transmission (framing, error detection/correction).
  • Reliability (ARQ, sliding window).
  • Medium access (CSMA/CD, CSMA/CA).
  • Addressing (MAC).
  • Switching (switch, MAC tables).
  • Real protocols (Ethernet, Wi-Fi, PPP, HDLC).
  • Extensions (VLAN, QoS).
  • The connection with the network level (ARP, LLC).

Key invariants

  1. Reliability is not fully guaranteed by the channel — it can be absent (Ethernet), partial (Wi-Fi), or strengthened at the upper levels (TCP).
  2. Errors are inevitable — therefore detection (CRC), correction (FEC), and retransmission (ARQ) are necessary.
  3. A shared channel requires coordination — MAC protocols resolve the access conflict.
  4. Performance is limited by RTT, window size, and the probability of collisions.

Deep understanding

The data link level operates only between neighboring nodes, does not know about routes, and operates with MAC addresses. It does NOT solve global delivery, routing, or end-to-end reliability. That is why Ethernet is unreliable, and TCP makes reliability higher up.
The data link level is a compromise between:

  • Reliability (ARQ, CRC).
  • Latency (larger windows → faster, but more complex control).
  • Throughput (MAC protocols, fighting collisions).
  • Complexity (Stop-and-Wait is simple, Selective Repeat is complex).

The data link level solves the tasks of transmission efficiency, local reliability, and medium access. But it does not guarantee end-to-end delivery, absence of losses, or ordering at the level of the whole network. Therefore TCP is still necessary, even if L2 is "reliable."

Many mechanisms of the data link level (sliding window, sequence numbers, ARQ) transfer directly into TCP. Understanding L2 is the foundation for understanding TCP congestion control, flow control, and reliable delivery.

The data link level turns the chaotic physical medium into a structured, managed, and shared network. It is not just "about transmission" — it is the system that creates the basis for all the higher levels of the network architecture.

🤖 Dubina