CSEC3616Cybersecurity Engineering

    The link layer and MAC addresses

    What the link layer moves between physically adjacent nodes, the services it provides, and how a MAC address differs from an IP address.

    • Define a frame and explain how it differs from a datagram.
    • List the link layer's core services.
    • State the size of a MAC address and explain what ARP is used for.

    12 min read

    Intuition

    A datagram addressed all the way to its final destination still has to get there one physical hop at a time, from one node to the next node it is directly connected to. That one-hop delivery, and the addressing scheme that makes it possible on a shared local network, is what the link layer and MAC addresses provide.

    Mechanism

    In link-layer terms, hosts and routers are nodes, and the communication channels connecting adjacent nodes along a path are links, wired, wireless, or a LAN. The layer-1 or layer-2 packet is called a frame, and it encapsulates a datagram. The link layer’s responsibility is exactly this: transferring a datagram from one node to the next, physically adjacent node over a single link, not across the whole path.

    Mechanism

    The link layer provides two kinds of service. Framing and link access encapsulates a datagram into a frame, with a MAC address in the frame header identifying the source and destination, a different address from the IP address used at the network layer. Reliable delivery between adjacent nodes covers flow control, error correction, error detection, and whether the link operates half-duplex or full-duplex.

    Mechanism

    Every interface on a Local Area Network (LAN) has a unique 48-bit MAC address, used purely locally: to get a frame from one interface to another interface it is physically connected to. The same interface also has a locally unique 32-bit IP address, as introduced on the previous page. Because a frame is addressed by MAC address but the network layer only knows the destination’s IP address, something has to map one to the other: the Address Resolution Protocol (ARP) finds the MAC address that corresponds to a given IP address.

    Compare

    48 bits. Used locally, to move a frame between two physically-connected interfaces on the same link. Belongs to the link layer.

    32 bits (IPv4). Used to identify an interface across the wider network and to route a datagram toward its eventual destination, potentially many hops away. Belongs to the network layer.

    Exam detail

    Keep straight which address does which job: a MAC address only ever gets a frame to the next physically adjacent interface, never further; an IP address is what makes end-to-end routing across the whole network possible in the first place. ARP is the bridge between the two, resolving an IP address to the MAC address needed for the next hop.

    Recall

    • The link layer moves a frame, which encapsulates a datagram, one hop at a time between physically adjacent nodes over a link.
    • Its two services are framing and link access (with MAC addressing), and reliable delivery between adjacent nodes (flow control, error correction and detection, half- or full-duplex).
    • A MAC address is 48 bits and only works locally; ARP resolves a known IP address to the MAC address needed to actually address a frame to it.

    Source

    Week 8 slides PDF