The Data Link Layer

The Data Link Layer
The Data Link layer is actually made up of two sublayers:

• The Media Access Control (MAC) sublayer
• The Logical Link Control (LLC) sublayer

Figure 2.12 illustrates this arrangement.

FIGURE 2 . 1 2 Sublayers of the Data Link layer

In the following sections, you will be introduced to various topics that all have one major thread in common: each topic is a separate piece of the Data Link puzzle. You will be presented with concepts from the definition of a frame to the format of a MAC address and with details of some of the most popular Data Link protocols on the market today. We’ll finish up with a survey of the most popular layer 2 devices in the industry.

Data Link Layer Concepts
Protocols that operate at the Data Link layer have several responsibilities, including creating, transmitting, and receiving frames. Additionally, the Data Link layer is responsible for physical
(MAC) addressing and logical link control (LLC) processing, creating logical topologies, and controlling media access.

Frames
At the Data Link layer, data coming from upper-layer protocols are divided into logical chunks called frames. A frame is a unit of data transmission. The size and format of these frames depend
on the transmission technology. In other words, Ethernet frames differ greatly from Token Ring frames and Frame Relay frames, and the three are not compatible (without some sort of intermediary
device to translate). Table 2.1 shows the names of the protocol data units (PDUs) at the layers that have distinctive data structures. Just as frames are presented here, the others will be

discussed further in their related sections.

TABLE 2 . 1 PDUs by Layer

ـــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــ
             Layer                               Protocol Data Unit
ـــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــ
            Application                        Message, datagram, or user data
            Transport                           Segment
            Network                             Packet
            Data Link                           Frame
            Physical                              Bits

ـــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــ


The Hardware (MAC) Address
Every interface that communincates over a LAN segment has a globally unique address, typically assigned at the factory. This address is protocol independent and is often called the hardware
address. It’s technically accurate, however, to call it the MAC address because it exists at the MAC sublayer of the Data Link layer.

Note:

The hardware address is also called the Ethernet address or the physical address.

The MAC address itself is a 48-bit value, commonly represented as a 12-digit hexadecimal number. As you may remember, the hexadecimal numbering system uses all digits from 0 through 9 and adds A through F. Each two-digit set is separated by colons, like so:

07:57:AC:1F:B2:76

Or some manufacturers display it with dashes, like so:

07-57-AC-1F-B2-76

The first three sets of digits (07-57-AC in the preceding example) are known as the Organizationally Unique Identifier (OUI), which is administered by the IEEE and uniquely identifies the manufacturer of the interface. The last three sets (1F-B2-76 in this example) form a value, sometimes referred to as the device ID, that the manufacturer must ensure exists only on a single manufactured interface that bears that OUI, making the entire 48-bit value unique worldwide. The OUI and the serialized suffix together make up a MAC address. Because the MAC address is almost universally permanently embedded in a ROM chip on the device, it is often referred to as a burned-in address (BIA).

   Normally, the MAC address of an interface is set at the factory and cannot be changed. For this purpose, all NIC manufacturers keep track of the MAC addresses they use so they don’t duplicate addresses internally among their products. The IEEE ensures that no two manufacturers legally use the same OUI. Again, this creates a globally unique identifier for each interface

manufactured by any registered vendor, barring rogue manufacturers from randomly creating their own OUI. Administrators are able to change the MAC addresses of the cards they receive (using a factory-supplied program), so if they discover a rare duplicate MAC address, they can resolve the conflict, or if they have an unrecommended locally administered addressing system, they can implement it. To that end, many operating systems (including Linux and Windows XP) allow a locally administered address (LAA) to overide the factory MAC address. The configuration procedure varies according to the software used, but it is usally a simple procedure.

Logical Topology
The Data Link layer also bears the responsibility of dictating the logical topology of a network, or the way the devices perceive the topology of the network. A logical topology differs from a physical topology in that the physical topology dictates the way the cables are laid out, whereas the logical topology dictates the way the information flows. The types of logical topologies are the same as the physical topologies except that the information flow specifies the type of logical topology in use. For example, in the early days of Ethernet, networks were physically wired using a bus topology. The MAC sublayer of the Data Link layer of the equipment attached to
this physical bus was designed to envision the network as a bus, making the logical topology a bus as well. Thus, that configuration is known as a physical bus/logical bus. Once twisted pair
and fiber were introduced into the Ethernet Physical layer, hubs were designed to allow the network to be wired as a physical star while allowing the devices attached to the hub to continue
to believe they were part of a bus, making this configuration a physical star/logical bus. Finally, the Data Link layer can describe the method of media access. There are three main
classifications of media access methods:

Contention Every device “competes” with other devices for the opportunity to transmit, andeach has an equal chance at transmitting. If two devices transmit at the same time, an error,

referred to as a collision, occurs and the devices try again.

Polling A central device, called a controller, polls each device in turn and asks if it has data to transmit. This type of media access virtually eliminates collisions.

Token Passing This uses a special data packet called a token. When a device has the token, it can transmit. If it doesn’t have the token, it can’t transmit. This media access technology also eliminates collision problems.

Media Access Methods
With many devices on the same piece of network media, there has to be a way of vying for time on the cable. This process is called media access, and there are three main methods:

Carrier Sense/Multiple Access with Collision Detection (CSMA/CD) 
This media access technology is probably the most common. When a protocol that uses CSMA/CD has data to transmit, it first senses if a signal is already on the wire (a carrier), indicating that someone is transmitting currently. That’s the “Carrier Sense” part. If no one else is transmitting, it attempts a transmission and then listens to hear if someone else tried to transmit at the same time. If someone else transmits at the exact same time, a collision occurs. Both senders “back off” and don’t transmit until some random period of time has passed. Then they both retry. That’s the 
“Collision Detection” part. The final part (“Multiple Access”) just means that more than one station can be on the network at the same time. CSMA/CD is the access method used in Ethernet and wireless Ethernet networks.

Token Passing In addition to being a broad classification of media access methods, token passing is actually a specific method of media acess unto itself. This media access method uses
a special packet called a token. The first computer that is turned on creates the token. It then passes on the token to the next computer. The token passes around the network until a computer
that has data to send takes the token off the network, modifies it, and puts it back on the network along with the data it has to send. Each station between the sender and the receiver along the network reads the destination address in the token. If the destination address doesn’t  atch its own, the station simply sends the package on its way. When the destination station recognizes its address in the destination address of the token, the NIC copies the data into the
station’s memory and modifies the token, indicating that it has received the data and recognized its own address in the frame. The token continues around the network until the original sender
receives the token again. If the original sender has more data to send, the process repeats itself (for a specific amount of time). If not, the sender modifies the token to indicate that the token
is “free” for anyone else to use. With this method, there are no collisions (as in CSMA/CD networks) because everyone has to have “permission” to transmit (via the token).

Carrier Sense/Multiple Access with Collision Avoidance (CSMA/CA) 
This technology works almost identically to CSMA/CD, but instead of sending the whole data chunk and then listening to hear if it was transmitted, the sender transmits a request to send (RTS) packet and waits for a clear to send (CTS) before sending. When it receives the CTS, the sender sends the chunk. AppleTalk networks use this method of media access. The difference between CSMA/
CD and CSMA/CA has been described like this: Say you want to cross a busy street and you want to use one of these protocols to cross it. If you are using CSMA/CD, you just cross the street. If you get hit, you go back to the curb and try again. If you’re using CSMA/CA, you send your little brother across. If he makes it, it’s probably OK for you to go.

Note:

While there does exist another media access method that had early promise, its timing on the market couldn’t have been worse. The method is demand priority, and it was used with the  00VGAnyLAN technology from HP. Today, it is nothing more than an aside in the annals of history, much as it is treated as an
aside here. Demand priority was a polling class of media access methods, leaving a large amount of the decision concerning whose turn it was to talk to the concentrator, as opposed to the NIC, which governs such choices in Ethernet and Token Ring. This is similar to the effect of attaching a NIC to a Layer 2 Switch and turning off CSMA/CD on the NIC, which allows the NIC to transmit at will. The switch is then responsible for deciding when the frame gets forwarded to the rest of the network.

Project 802
One of the major components of the Data Link layer is the result of the Institute of Electrical and Electronics Engineers’s (IEEE’s) 802 subcommittees and their work on standards for local area and metropolitan area networks (LANs/MANs). The committee met in February 1980, so they used the “80” from 1980 and the “2” from the second month to create the name Project 802. The designation for an 802 standard always includes a dot (.) followed by either a single or a double digit. These numeric digits specify particular categories within the 802 standard. 
Currently, there are 12 standards. These standards, shown in Figure 2.13, are listed in Table 2.2 and described in more detail in the following sections.

TABLE 2 . 2 IEEE 802 Networking Standards

ـــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــ
 Standard         Topic
ـــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــ
802.1                 LAN/MAN Management (and Media Access Control Bridges)
802.2                 Logical Link Control
802.3                 CSMA/CD
802.4                 Token Bus
802.5                 Token Ring
802.6                 Distributed Queue Dual Bus (DQDB) Metropolitan Area  
                                             Network (MAN)
802.7                 Broadband Local Area Networks
802.8                 Fiber-Optic LANs and MANs
802.9                 Isochronous LANs
802.10               LAN/MAN Security
802.11               Wireless LAN
802.12               Demand Priority Access Method
802.15               Wireless Personal Area Network
802.16               Wireless Metropolitain Area Network
802.17               Resilient Packet Ring
802.18               LAN/MAN Standards Committee
ـــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــ

Note:

Some standards have a letter to further distinguish the standard (e.g., 802.11b).
The letters usually refer to different versions or interpretations of the standard.

FIGURE 2 . 1 3 The IEEE standards’ relationship to the OSI model

The 802.1 LAN/MAN Management (and Media Access Control Bridges) 
IEEE 802.1 discusses standards for LAN and MAN management, as well as for MAC bridges. One of the derivatives of 802.1 is the spanning tree algorithm for network bridges and switches,
802.1d (bridges and switches are discussed later in this chapter). The spanning tree algorithm helps to prevent switching loops in a switched network. See the upcoming section on 802.10 for
its comparison with another popular 802.1 specification.

The 802.2 Logical Link Control
This standard specifies the operation of the Logical Link Control (LLC) sublayer of the Data Link layer of the OSI model.The LLC sublayer provides an interface between the MAC sublayer
and the Network layer. The 802.2 standard is used by the IEEE 802.3 Ethernet specification (discussed next) but not by the earlier Ethernet 2 specifications (used in early implementations
of Ethernet).

The 802.3 CSMA/CD
This standard specifies a network that uses a bus topology, baseband signaling, and a CSMA/CD network access method. This standard was developed to match the Digital, Intel, and Xerox
(DIX) Ethernet networking technology. So many people implemented the 802.3 standard, which resembles the DIX Ethernet, that people just started calling it Ethernet. It is the most
widely implemented of all the 802 standards because of its simplicity and low cost. 
    Recently the 802.3ae working group updated 802.3 to include Gigabit Ethernet implementations.

The 802.5 Token Ring
This standard is one example of a commonly used product becoming a documented standard. Typically, a standard is developed and then products are written to conform to the standard. Token Ring was developed by IBM in 1984, and the 802.5 standard soon followed. The 802.5 standard and Token Ring are almost identical.
    Like Ethernet, Token Ring can use several cable types. Most often, it is installed using twisted-pair cabling, which can be either shielded or unshielded. Shielding adds to the cable investment but offers the advantage of resistance to unwanted electrical signals that could impair the network signal.
    Possible transmission rates for Token Ring have increased with time; after 4Mbps Token Ring came 16Mbps Token Ring. Token Ring uses a physical star, logical ring topology with
token-passing media access. If you install 4Mbps NICs on a network that otherwise uses 16Mbps NICs, your entire ring speed is reduced to 4Mbps. Unlike with Ethernet, a computer cannot talk unless it has a token. This can cause some grief if a token gets “stuck.”

Although nowhere near as popular as Ethernet, Token Ring is still used in a number of locations for two reasons:

• IBM made sure that Token Ring did a fine job of talking to IBM mainframes, which are still used.
• Token Ring network performance “degrades with grace.”

The latter means that as network traffic increases, the network slowly gets slower because the single token, which can travel in only one direction, gets busy servicing all that demand. Ethernet, on the other hand, can become so flooded as network traffic increases that the entire network collapses. Now, suppose you were wiring a computerized fire alarm system for a large building. Which would you rather use: Ethernet or Token Ring? To increase performance, some Token Ring technologies implement early token release, whereby the sending station doesn’t hog the token. It simply grabs the token, sends its data, and frees the token. In Token Ring, just as in most Ethernet schemes, there is a central device to which stations connect. It isn’t, however, called a hub. IBM calls it a MAU. IBM often has a different name for things. Even its name for Token Ring cabling is different. In telephone and computer networks, twisted cable is rated by categories. IBM rates Token Ring cable by type. 
One final difference between Token Ring and the others is the regeneration process. Data signals are read, amplified, and repeated by every device on the network to reduce degradation. This includes MAUs and NICs and is one reason that Token Ring was once so much more expensive than Ethernet.

The 802.10 LAN/MAN Security
The 802.10 Standards for Interoperable LAN/MAN Security (SILS), ratified in late 1992, were originally designed to provide security within shared LAN/metropolitan-area network (MAN)
environments. The 802.10 protocol incorporates a mechanism whereby LAN traffic can carry a virtual LAN (VLAN) identifier in the header of its frames, allowing selective switching of frames
based on their identifier. Interfaces that were members of one VLAN could not exchange frames with interfaces in another VLAN, creating security. 802.10 incorporates authentication and
encryption to ensure data confidentiality, further enhancing security. 802.10 enjoyed some success in FDDI environments but has waned in popularity in recent years in favor of other frametagging protocols, such as IEEE 802.1Q and Cisco’s proprietary Inter-Switch Link (ISL) protocol.

The 802.11 Wireless LAN
Wireless networking usually requires a higher up-front investment than cable-based networking. Still, the cost can be justified if an office is rearranged with any regularity or must be moved
from location to location to satisfy business requirements. A famous example of this is the Red Cross. This agency would not be effective if it had to wire computers together before assisting

at each disaster area.
    Recently, 802.11 was updated to include the 802.11a, b, and g standards, which specify higher wireless speeds compared to the original 1Mbps of 802.11. 802.11b is the next faster specification,
with bit rates of 11Mbps. Both 802.11a and 802.11g post speeds of 54Mbps, but they do so in different ways. 802.11a uses a 5GHz signal, which makes it effective only at shorter distances, as well
as incompatible with 802.11b’s 2.4GHz signal, but places it in a much less-crowded bandwidth. Neither one interferes with the other at least. 802.11g, however, shares the lower 2.4GHz frequency of 802.11b, making interoperation of the faster 802.11g end devices with the slower 802.11b access points rather easy through simple rate adaption over the same frequency. Nevertheless, some manufacturers offer NIC cards, for example, that combine all three technologies and allow the device to
autosense the capability of the strongest access point in order to allow the modest installed base of more expensive 802.11a access points to play successfully with the others. But the bottom line is that 802.11a is incompatible with the other two specifications.

The 802.12 Demand Priority Access Method
First developed by Hewlett-Packard, this standard combines the concepts of Ethernet and Token Ring. The communication scheme used is called Demand Priority (thus, the name of the standard). It uses “intelligent” hubs that allocate more bandwidth to frames that have been assigned a higher priority by the sending computer. The hub scans its ports and then allocates bandwidth according to each frame’s priority. This is extremely valuable for real-time audio
and video transmissions.
      The 802.12 standard is also known as 100VG (Voice Grade), 100VG-AnyLAN, 100Base-VG, and AnyLAN. The 100 is short for 100Mbps, or 10 times faster than the original Ethernet speeds. Other manufacturers didn’t buy into the ideas of 100VG, perhaps in part because of the higher overhead of demand priority due to port scanning. Instead, they updated the original Ethernet to Fast Ethernet, which also supports 100Mbps while maintaining the 802.3 standards. Table 2.3 summarizes the main features—including speed, access method, topology, and

media—of various network standards, such as the most common 802 MAC standards and FDDI.

Data Link Layer Devices

Three main devices manipulate data at the Data Link layer:

• Bridges
• Switches
• Wireless access points (WAPs)

They are more complex than their Physical layer counterparts and thus are more expensive and more difficult to implement. But they each bring unique advantages to the network.

TABLE 2 . 3 Main Features of Various Network Technologies

The Bridge
A bridge is a network device, operating at the Data Link layer, that logically separates a single network into two segments, but it lets the two segments appear to be one network to higherlayer
protocols. The primary use for a bridge is to keep traffic meant for devices on one side of the bridge from passing to the other side. For example, if you have a group of workstations that constantly exchange data on the same network segment as a group of workstations that don’t use the network much at all, the busy group will slow down the performance of the network for the other users. If you put in a bridge to separate the two groups, however, only traffic destined for a workstation on the other side of the bridge will pass to the other side. All other traffic stays local. Figure 2.14 shows a network before and after bridging.

Note:

Bridges can connect dissimilar network types (for example, Token Ring and Ethernet) as long as the bridge operates at the LLC sublayer of the Data Link layer. If the bridge operates only at the lower sublayer (the MAC sublayer), the bridge can connect only similar network types (Token Ring to Token Ring and Ethernet to Ethernet).

The Switch
The switch is more intelligent than a hub in that it can actually understand the frames that pass through it.
      A switch (also known as a Layer 2 switch) builds a table of the MAC addresses of all the

devices connected to it (see Figure 2.15).

FIGURE 2 . 1 4 A sample network before and after bridging

FIGURE 2 . 1 5 A switch builds a table of all MAC addresses of all connected stations.

When two devices attached to the switch want to communicate, the sending device sends its data on to its local segment. This data is heard by the switch (similar to the way a hub functions).
However, when the switch receives the data, rather than duplicating it out to all the ports as a hub would, it examines the Data Link header for the MAC address of the destination device and forwards
it to the correct port. This process triggers a function within the switch that opens a virtual pipe between ports that can use the full bandwidth of the topology because the switch has a nonblocking

backplane, able to support the collective bandwidth offered by the sum of its ports.

Switches have risen to the high level of popularity they enjoy today because of their ability to prevent collisions from occurring  etween the devices attached directly to their ports, thus increasing overall network throughput and efficiency. This stems from the fact that every port on a switch is in a different collision domain. A collision domain is that group of devices whose frames could potentially collide with one another. If a server were connected to a 100Mbps port on an Ethernet switch and 10 workstations were directly and individually connected (not through a hub connected to the switch) to 10Mbps ports on the same switch, each workstation would effectively have a dedicated, non-blocking 10Mbps channel to the server and there would never be any collisions. Thus, the inclusion of a switch in a network serves the function of increasing the number of collision domains while reducing the average population of all collision domains for the same number of nodes.
   Layer 2 Switches differ from their layer 3 counterparts, which are able to operate on the layer 3 packets by routing the first packet between a source and destination because it stores the
actual header required to build the outbound frame. It then rapidly switches subsequent packets between the same two devices in software or even hardware without looking up the layer 3 routing

information again.

The Wireless Access Point
If you are going to connect multiple wireless computers to an existing wired network, you will need at least one wireless access point (WAP). The WAP is essentially a wireless bridge (or
switch, as multiple end devices can connect simultaneously). It operates by connecting wireless clients together. In addition, it can connect those wireless clients to a wired network. As with
a bridge or switch, the WAP indiscriminately propagates all broadcasts to all wireless and wired devices while allowing filtering based on MAC addresses.
     The WAP contains at least one radio antenna that it uses to communicate with its clients via radio frequency (RF) signals. The WAP can (depending on software settings) act as either an
access point, which allows a wireless user transparent access to a wired network, or a wireless bridge, which will connect a wireless network to a wired network yet only pass traffic it knows

belongs on the other side.

Note:

Wireless networks will be covered in more detail in Chapter 6.