Ethernet: Delivery on One Local Network

The link layer’s job is small and local: get a frame from one interface to another interface on the same physical network — the same segment — without any notion of what lies beyond. An Ethernet frame is a destination MAC, a source MAC, an EtherType saying what the payload is, 46–1500 bytes of payload, and a 4-byte CRC. Nothing in it says which network the sender or receiver is on, because on a segment there is only one.

Historically the segment was literally one cable: every station saw every frame, read the destination MAC, and kept only its own. Two stations transmitting at once produced a collision, detected by CSMA/CD and resolved by random backoff; the set of stations that could collide was the collision domain, and it shrank with every hub replaced by a switch. On modern full-duplex switched Ethernet collisions do not occur — each cable carries one station in each direction — and the term survives only in textbooks and in Wi-Fi, where the air is still shared.

What does survive is the broadcast domain: the set of interfaces that receive a frame sent to ff:ff:ff:ff:ff:ff. ARP requests, DHCP discovery and IPv6 neighbor solicitation (as multicast) all depend on it. A broadcast domain is what "local network" means at the link layer, and a router is precisely the device that ends one.

A switch is a multi-port bridge with a MAC address table (also called the CAM table or forwarding database) mapping MAC → port. It starts empty. It fills the table by learning from source addresses: every frame that arrives on port 3 with source aa:..:03 teaches the switch that aa:..:03 is reachable via port 3. No configuration, no protocol — just observation. Entries age out (typically after 300 s of silence) so that a laptop moved to another port is relearned.

Forwarding uses the table in the other direction. A frame arrives; the switch looks up its destination MAC. If the table has it, the frame is copied out of that one port and no other — this is what makes a switch private where a hub was not. If the table does not have it, or the destination is broadcast or multicast, the switch floods the frame out of every port except the one it came in on. The reply from the unknown destination will carry its MAC as source, the switch learns it, and the next frame is unicast. Flooding is the bootstrap, not the steady state.

The table is a hash lookup on a 48-bit key, done in hardware at line rate for every frame. Enterprise switches hold tens of thousands of entries; the classic attack is MAC flooding — sending frames from millions of fake sources until the table is full and the switch degrades to flooding everything, which lets an attacker on any port see all traffic.

One physical switch often needs to be several logical networks — guests must not see printers, the phone system must not share a broadcast domain with 400 laptops. A VLAN tags each port (or each frame, with an 802.1Q header inserted after the source MAC) with a 12-bit VLAN id, and the switch keeps a separate MAC table and a separate broadcast domain per VLAN. A frame in VLAN 10 is never forwarded or flooded to a VLAN 20 port. Crossing between VLANs requires a router — exactly as crossing between physical networks does — which is what a layer-3 switch does internally.

A trunk port carries several VLANs, each frame tagged, between two switches or to a router; an access port belongs to one VLAN and its frames are untagged. Most container and cloud networking (VXLAN, overlays) is this idea scaled up: a virtual segment identifier that keeps tenants’ broadcast domains apart over shared hardware.

802.11 is not Ethernet: the medium is shared air, half-duplex, with collisions avoided rather than detected (CSMA/CA — listen, wait a random slot, transmit, wait for an acknowledgment). Frames have up to four MAC address fields (source, destination, transmitter, receiver, because the access point relays), the header is longer, and the link layer retransmits on a missing acknowledgment — which is why a lossy Wi-Fi link shows up to IP as jitter and delay rather than loss. Rates adapt per frame to signal quality; a 1 Gbit/s label describes the best case for one client at close range with nothing else talking.

But from IP’s point of view Wi-Fi is another link with 48-bit MAC addresses, an MTU of 1500, broadcast and multicast, and ARP or Neighbor Discovery on top. The access point bridges Wi-Fi frames to Ethernet frames — same source and destination MACs, different framing — and your laptop is in the same broadcast domain as the wired desktop. The practical consequences: Wi-Fi is where most "the network is slow but nothing is dropping" complaints originate, and where MAC randomisation and roaming between access points make link-layer identity unstable.