CSS334 — Link Layer (Part 2) Cheat Sheet

Exam-ready summary | Lecture 12 | All topics included

1. Ethernet

• Dominant wired LAN technology — first widely used, simple, cheap
• Speed range: 10 Mbps → 400 Gbps (same fundamental MAC protocol throughout)
• All variants share the same MAC protocol and frame format — only speed and physical media differ
• Single NIC chip can support multiple speeds (e.g., 10/100/1000 auto-negotiation)

Analogy: Ethernet is like a highway that keeps getting extra lanes added — the road rules stay the same, just more capacity.

⚠️ To run 10 Gbps Ethernet end-to-end, every component in the path must support it: NIC + Switch + Router.

2. Ethernet Frame Structure

┌──────────┬────────┬────────┬──────┬─────────────┬─────┐
│ Preamble │ Dst MAC│ Src MAC│ Type │ Data/Payload │ CRC │
│  8 bytes │ 6 bytes│ 6 bytes│2 byte│  46–1500 B  │ 4 B │
└──────────┴────────┴────────┴──────┴─────────────┴─────┘

Frame Acceptance Rules (at the NIC)

Type Field — Upper Layer Demultiplexing

3. Ethernet: Connectionless & Unreliable

Analogy: Sending a letter without tracking — might arrive, might not. Only TCP (the sender) would notice if it's lost.

4. Ethernet Standards Reference

Naming pattern: [speed]BASE-[medium] — e.g., 1000BASE-T = 1 Gbps, baseband, twisted pair

5. UTP Cable (Unshielded Twisted Pair)

• Most common physical medium for Ethernet
• Uses RJ45 connector, T-568B standard wiring

T-568B Pin Order (Memorise!)

Patch vs Crossover Cable

Modern NICs support Auto-MDIX — auto-detect and adjust, so either cable type works.

UTP Categories

Rule of thumb: CAT5e for Gigabit, CAT6a for 10 Gigabit at full 100m distance.

6. Switches

Network Device Comparison

Switch Key Properties

• Link-layer device (L2) — reads MAC addresses
• Store-and-forward: receives entire frame, checks CRC, then forwards
• Transparent: hosts are completely unaware the switch exists
• Plug-and-play, self-learning: no manual configuration needed
• Each port = its own collision domain → full-duplex, zero collisions

Analogy: Smart post office — reads the address on each envelope (MAC) and delivers only to the right mailbox. A hub just dumps all mail on every desk.

Simultaneous Transmissions

• A→A' and B→B' simultaneously → ✅ allowed (different destination ports)
• A→A' and C→A' simultaneously → ❌ blocked (same destination port — can't write to same port at once)

7. Switch Self-Learning & Forwarding

Switch Forwarding Table Entry Format

$\boxed{(\text{MAC Address},\ \text{Interface/Port},\ \text{TTL})}$

Self-Learning Algorithm (Step-by-Step)

Frame arrives at switch on interface X:
  1. Record (src MAC → interface X) in table   ← always learn the SOURCE
  2. Look up DESTINATION MAC in table:
       Found → forward to that interface only    ← selective forward
       Not found → FLOOD (send to all except X)  ← unknown destination
       Dst is on same interface X → DROP          ← no need to resend

Self-Learning Example (A sends to A')

First time: flood to all ports (except source). Every subsequent time: selective forward.

⚠️ Other nodes that received the flooded frame check the destination MAC — if it's not theirs, they discardit.

Multi-Switch Self-Learning

• Works identically across interconnected switches
• Each switch learns from traffic it sees — no central coordination needed
• Frame from C to I (across S1 → S4 → S3): first time floods through all switches; each switch learns the path; future frames selectively forwarded

8. Switch Types

L2 vs L3 Switch vs Router

Managed vs Unmanaged Switch

Need VLANs, routing, 802.1X auth, SNMP monitoring → must use managed switch

Power over Ethernet (PoE)

• Delivers power + data over a single UTP cable (up to 100m)
• Devices powered: IP Phones, Wireless APs, IP Cameras — no separate power cable
• If switch doesn't support PoE natively → use a PoE injector inline

Switch vs Router (Detailed)

9. VLANs — Virtual Local Area Networks

Why VLANs?

Problem with a single large LAN (one big broadcast domain):

• Every ARP, DHCP, and unknown-MAC frame floods the entire network — scales badly
• Security: all traffic visible to all nodes
• Privacy: department A can see department B's broadcasts
• Administrative: user physically moves but logically should stay in same group

Solution: VLANs — divide one physical switch into multiple logically isolated virtual switches

Analogy: Soundproof walls between departments in an open-plan office — Finance and Engineering can't hear each other's internal announcements.

Port-Based VLANs

• Switch ports grouped by admin into different VLANs
• One physical switch behaves like multiple independent virtual switches

Physical Switch:
  Ports 1–8  → VLAN 10 (Engineering)
  Ports 9–15 → VLAN 20 (Finance)
  Port 16    → Trunk port (to router / another switch)

VLAN Properties

10. VLANs Across Multiple Switches — Trunk Links

The Problem

• Two switches on different floors, each with VLAN 10 and VLAN 20
• Naïve solution: run one cable per VLAN between switches → 2 cables, scales badly
• Better solution: Trunk port — one cable carries all VLANs

Trunk Port

• Carries frames from multiple VLANs over a single link between switches
• Uses IEEE 802.1Q (Dot1q) to tag frames with their VLAN ID
• Switch adds tag on ingress to trunk, removes tag on egress to access port

802.1Q Frame Format

┌──────────┬────────┬────────┬────────────┬──────┬─────────────┬────────────┬─────┐
│ Preamble │ Dst MAC│ Src MAC│ 802.1Q Tag │ Type │ Data/Payload │ (new) CRC  │     │
│  8 bytes │ 6 bytes│ 6 bytes│  4 bytes   │ 2 B  │  46–1500 B  │  4 bytes   │     │
└──────────┴────────┴────────┴────────────┴──────┴─────────────┴────────────┴─────┘

The 4-byte 802.1Q tag (inserted after Src MAC):

$\boxed{\text{Max VLAN ID} = 2^{12} - 2 = 4094 \text{ usable VLANs (0 and 4095 reserved)}}$

CRC is recomputed after adding the tag — tag changes the frame size so old CRC is invalid.

802.1Q Key Details

Port Types (Exam Important ⚠️)

11. VLAN vs Subnet (Key Distinction)

Rule of thumb: one VLAN = one subnet. VLANs enforce L2 isolation; subnets enforce L3 addressing. Inter-VLAN = inter-subnet = needs a router.

12. A Day in the Life of a Web Request

Scenario: Laptop connects to school network, opens browser → types www.google.com

Every protocol that fires, in order:

Step 1 — DHCP: Get an IP Address

Laptop has no IP → broadcasts DHCP Discover

DHCP Discover → DHCP Offer → DHCP Request → DHCP ACK

$\boxed{\text{DHCP} \rightarrow \text{UDP (ports 68→67)} \rightarrow \text{IP (0.0.0.0→255.255.255.255)} \rightarrow \text{Ethernet (broadcast FF:FF:FF:FF:FF:FF)}}$

After DHCP ACK, laptop knows:

• Its own IP address
• Default gateway IP (first-hop router)
• DNS server IP + name

Step 2 — ARP: Find the Router's MAC

Laptop knows the router's IP (from DHCP) but needs its MAC to build an Ethernet frame.

ARP Request (broadcast) → "Who has 192.168.1.1?"
ARP Reply (unicast)     → "That's me. My MAC is E6:E9:00:17:BB:4B"

$\boxed{\text{ARP broadcast} \rightarrow \text{router replies with its MAC} \rightarrow \text{cached in ARP table}}$

Laptop can now address Ethernet frames to the router.

Step 3 — DNS: Resolve www.google.com

Laptop needs the IP address of www.google.com.

DNS Query → UDP → IP (dst: DNS server) → Ethernet (dst MAC: router) → forwarded by router
DNS Reply ← "www.google.com = 64.233.169.105"

$\boxed{\text{DNS} \rightarrow \text{UDP (port 53)} \rightarrow \text{IP} \rightarrow \text{Ethernet} \rightarrow \text{routed via OSPF/BGP to DNS server}}$

Step 4 — TCP: 3-Way Handshake

Before HTTP, establish a reliable connection to Google's web server.

SYN     → laptop to 64.233.169.105   (I want to connect)
SYNACK  ← Google server              (OK, I'm ready)
ACK     → laptop to Google           (Great, let's go)

$\boxed{\text{SYN} \rightarrow \text{SYNACK} \rightarrow \text{ACK} \quad (\text{TCP connection established})}$

Step 5 — HTTP: The Actual Web Request

HTTP GET / HTTP/1.1
Host: www.google.com
→ routed to 64.233.169.105
← HTTP 200 OK + HTML content
→ browser renders page

$\boxed{\text{HTTP} \rightarrow \text{TCP} \rightarrow \text{IP} \rightarrow \text{Ethernet} \rightarrow \text{routed to Google}}$

Full Summary: All Protocols for One Web Request

Analogy: Ordering delivery from a new restaurant — look up their address (DNS), call a taxi (ARP/routing), taxi takes you there (TCP connection), you order and food arrives (HTTP). Even "just typing a URL" triggers all 5 protocols across all 4 layers.

Quick Reference Summary