Ethernet, Wireless LANs and LAN Switching

Introduction

Local area networks (LANs) connect computers, servers, printers, access points, cameras and other devices within a limited geographical area. Ethernet remains the dominant wired LAN technology, while IEEE 802.11 wireless LANs provide mobility and flexible access. Modern LANs depend on switches, virtual LANs (VLANs), trunk links, loop-prevention protocols and wireless security mechanisms.

This chapter develops the knowledge needed to configure and troubleshoot small and medium-sized Ethernet and Wi-Fi networks. It also explains how switches make forwarding decisions, how VLANs separate broadcast domains, how trunking carries multiple VLANs, and how redundancy can be provided safely.

Learning Objectives

By the end of this chapter, you should be able to:

• explain Ethernet framing and MAC addressing;
• distinguish hubs, bridges, switches and routers;
• interpret a MAC address and a switch MAC address table;
• configure basic switch ports, VLANs and trunk links;
• explain broadcast domains, collision domains and inter-VLAN routing;
• describe Spanning Tree Protocol and link aggregation;
• explain Wi-Fi operation, WLAN components and basic wireless security;
• apply structured troubleshooting and security practices to a LAN.

1. Ethernet Foundations

Ethernet is specified primarily by the IEEE 802.3 family of standards. It defines functions at the data-link and physical layers. The data-link layer organizes bits into frames and uses MAC addresses; the physical layer defines media, signaling and transmission speeds.

Traditional shared Ethernet used Carrier Sense Multiple Access with Collision Detection (CSMA/CD). A station listened before transmitting and detected collisions on a shared medium. Modern switched full-duplex Ethernet normally has one dedicated link between each host and switch port. Collisions do not occur on such links, so CSMA/CD is not used operationally.

Common Ethernet media include:

Ethernet data rates range from legacy megabit systems to modern multi-gigabit and 100-Gbit/s systems. The selected cable category, transceiver, distance and switch capability must be compatible. Auto-negotiation commonly allows devices to select a supported speed and duplex mode, but poor cabling or manually mismatched settings can reduce performance.

Ethernet Frame Structure

An Ethernet frame contains control information and a payload. Its principal fields are:

The standard Ethernet frame, excluding the preamble and inter-frame gap, has a minimum size of 64 octets and a maximum standard size of 1518 octets when the four-octet FCS is included. VLAN tagging adds a four-octet 802.1Q field and changes the maximum tagged frame size accordingly. Jumbo frames exceed the conventional maximum, but they require consistent support across the path.

The FCS detects many transmission errors but does not correct them. A frame failing the check is normally discarded, and recovery is left to higher-layer protocols such as TCP or to an application-specific mechanism.

2. MAC Addressing

A MAC address identifies a network interface at the data-link layer. A conventional Ethernet MAC address is 48 bits, written as six hexadecimal octets, for example 00:1A:2B:3C:4D:5E.

The first 24 bits are commonly associated with an organizationally unique identifier (OUI), while the remaining bits identify an interface under that organization’s allocation. Modern devices may also use locally administered addresses, especially for privacy features in wireless clients.

Two important bits in the first octet are:

• the individual/group bit: 0 indicates an individual unicast address and 1 indicates a group address;
• the universal/local bit: 0 traditionally indicates globally administered addressing and 1 indicates locally administered addressing.

A unicast address identifies one interface. A multicast address identifies a group. The broadcast address is FF:FF:FF:FF:FF:FF and is delivered within the relevant Layer 2 broadcast domain.

MAC addresses are not substitutes for IP addresses. MAC addresses support local frame delivery, whereas IP addresses support logical addressing and routing between networks. A host may retain the same MAC address while changing IP networks, and privacy mechanisms may cause a wireless client to use different locally administered MAC addresses over time.

3. Bridges and Switches

A switch is a multiport bridge. It learns which MAC address is reachable through each port by examining the source address of incoming frames. It then consults its MAC address table when forwarding frames.

The basic process is:

1. Receive a frame and record the source MAC address against the incoming port and VLAN.
2. Examine the destination MAC address.
3. If the destination is known on another port, forward the frame only there.
4. If the destination is unknown, flood the frame within the same VLAN, excluding the incoming port.
5. Flood broadcast and relevant multicast traffic within the VLAN.
6. If the destination is associated with the incoming port, filter the frame rather than sending it back.

Entries age out because devices can move, links can fail and addresses can change. A switch table must be interpreted together with VLAN information: the same MAC address may legitimately appear in different VLAN contexts.

A hub repeats incoming electrical signals to all ports and creates one shared collision domain. A switch creates separate collision domains, normally allowing full-duplex communication. A router separates broadcast domains and makes forwarding decisions using Layer 3 addresses.

Forwarding Example

Suppose a switch has learned that host A is on port 1 and host B is on port 4 in VLAN 10. When A sends a unicast frame to B, the switch forwards it from port 1 to port 4. If the destination is not in the table, the switch floods the frame to other active ports in VLAN 10. When B replies, the switch learns B’s location and future forwarding becomes more selective.

A loop in a switched network is dangerous because Ethernet frames have no general Layer 2 time-to-live. Broadcasts and unknown unicasts can circulate repeatedly, MAC addresses can alternate between ports, and links can become saturated. Redundancy must therefore be combined with loop prevention.

4. VLANs and 802.1Q Trunking

A virtual LAN (VLAN) is a logical Layer 2 broadcast domain. VLANs allow one physical switching infrastructure to support separate logical networks, such as staff, students, voice devices, guests and management systems.

VLANs provide segmentation, but they are not a complete security boundary. Misconfiguration, routing policy, switch vulnerabilities or unauthorized access to network equipment can undermine separation. Sensitive environments require firewalls, access controls and monitoring in addition to VLANs.

An access port normally carries traffic for one VLAN and connects to an end device. A trunk port carries traffic for multiple VLANs, usually between switches, between a switch and a router, or between a switch and a virtualization host.

IEEE 802.1Q identifies a VLAN by a 12-bit VLAN ID. VLAN IDs 0 and 4095 are reserved, so the commonly usable range is 1–4094, subject to platform and standard considerations. An 802.1Q tag contains priority and control information as well as the VLAN identifier. Frames belonging to a configured native VLAN may be transmitted untagged on some trunk implementations; native VLAN behavior must match at both ends.

A typical design might use:

Devices in different VLANs cannot communicate directly at Layer 2. Inter-VLAN communication requires a Layer 3 device, such as a router or multilayer switch. The Layer 3 device provides a gateway interface in each VLAN and applies routing and security policy.

Basic Configuration Logic

Although command syntax varies by vendor, the logic is consistent:

• create and name the VLANs;
• assign end-device ports as access ports in the correct VLAN;
• configure uplinks as trunks;
• restrict trunk allowed VLANs to those required;
• configure the native VLAN deliberately and consistently;
• provide gateway interfaces for VLANs that require routed communication;
• shut down unused ports or place them in an isolated, unused VLAN.

A trunk mismatch can produce partial connectivity, missing broadcasts, or unexpected security exposure. Always verify both ends using operational commands rather than relying only on configuration files.

5. Spanning Tree and Link Aggregation

Spanning Tree Protocol

Spanning Tree Protocol (STP), standardized in the IEEE 802.1D family and improved by Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w), prevents Layer 2 loops while preserving selected redundant paths.

The protocol elects a root bridge. Each non-root switch selects a best path toward the root, and redundant ports are placed in a non-forwarding state. The resulting active topology is logically loop-free. If an active path fails, STP can activate a previously blocked path.

Important concepts include:

• Bridge ID: a value used in root election, consisting principally of bridge priority and MAC-related information;
• root bridge: the switch with the best Bridge ID;
• root port: the best port on a non-root switch toward the root;
• designated port: the forwarding port selected for a network segment;
• path cost: a value representing the relative cost of reaching the root;
• BPDU: a Bridge Protocol Data Unit used to exchange spanning-tree information.

RSTP converges faster than traditional STP. Edge or PortFast settings can allow an end-device port to enter forwarding quickly, but they should not be used on ports where another switch might be connected. Features such as BPDU Guard can disable an edge port if a BPDU appears, protecting the topology from accidental or unauthorized switching devices.

Root placement should be intentional. In a campus design, the root is normally placed on a reliable, central distribution switch rather than being selected accidentally by default priorities.

Link Aggregation

Link aggregation combines multiple physical links into one logical bundle. IEEE 802.1AX, historically associated with the Link Aggregation Control Protocol (LACP), supports negotiation and monitoring of member links.

Benefits include increased aggregate capacity, redundancy and simplified logical topology. It does not normally make one individual flow faster than the capacity selected by the hashing algorithm; a single flow may use one member link while multiple flows are distributed across members.

All member links must have compatible speed, duplex, VLAN, trunk and configuration parameters. A partial or inconsistent bundle can cause forwarding errors or loops. LACP should be preferred over undocumented static assumptions where supported.

6. Wireless LANs

A wireless LAN uses radio communication defined primarily by the IEEE 802.11 family. A basic infrastructure WLAN contains wireless stations and an access point (AP). The AP provides radio connectivity and commonly bridges wireless frames to a wired VLAN.

Important terms include:

• station (STA): a wireless client;
• access point: a device that provides WLAN service and connects it to a distribution system;
• SSID: the human-readable network name advertised or used by a WLAN;
• BSSID: the identifier of a particular basic service set, often represented by an AP radio MAC address;
• BSS: an AP and its associated stations;
• ESS: multiple coordinated BSSs using a common service identity to support roaming;
• channel: a defined portion of radio spectrum;
• association: the process by which a client joins an AP after discovery and authentication steps.

Wi-Fi uses Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA), not Ethernet’s traditional collision detection. A station listens, waits according to inter-frame rules and contention procedures, and may use acknowledgements and retransmissions. A wireless station cannot reliably detect a collision while transmitting, and hidden nodes may be unable to hear one another even though both can reach the AP.

The practical throughput of a WLAN is lower than its advertised physical rate because of contention, protocol overhead, acknowledgements, retransmissions, management traffic, signal conditions and shared-medium operation. Radio planning must consider channel overlap, attenuation, interference, client density and required application performance.

The 2.4 GHz band often provides greater range but has fewer non-overlapping channels and more interference. The 5 GHz and newer 6 GHz bands can offer more spectrum and capacity, subject to local regulations, device support and shorter propagation range. Wider channels may increase peak rate but can reduce the number of independent channels and make interference more consequential.

Wireless Security

The preferred contemporary enterprise mechanisms are WPA2-Enterprise or WPA3-Enterprise with 802.1X authentication, a supplicant, an authenticator (usually the AP or WLAN controller) and an authentication server such as RADIUS. Enterprise authentication permits individual identities, central policy and improved accountability.

For small networks, WPA2-Personal or WPA3-Personal uses a shared passphrase. A long, unique passphrase is essential. WEP and legacy WPA with weak protocols are obsolete and should not be deployed.

Useful controls include:

• strong encryption and authentication;
• separate guest and internal SSIDs mapped to different VLANs;
• client isolation for guest networks where appropriate;
• disabling unnecessary management services;
• firmware updates and secure administrative passwords;
• monitoring for rogue APs and unauthorized clients;
• careful treatment of SSID visibility, since hiding an SSID is not meaningful security;
• protected management frames where supported.

Wireless security also involves privacy. Device identifiers, connection logs and authentication records may be personal data under applicable law. Organizations should define retention, access and incident-response policies.

7. Practical Configuration and Troubleshooting

A disciplined implementation begins with a requirements statement: users, applications, expected traffic, availability, security, coverage and growth. The designer then selects topology, cabling, switch capacity, VLANs, addressing, wireless channels and management controls.

A useful troubleshooting sequence is:

1. Physical: inspect power, link indicators, connectors, cable type, radio coverage and interference.
2. Data link: verify speed, duplex, VLAN membership, trunk state, MAC learning, STP state and error counters.
3. Network: verify IP address, subnet mask, default gateway, DHCP and DNS.
4. Transport/application: test the required service, authentication and firewall policy.
5. Documentation: record the finding, correction and evidence.

Common symptoms provide clues. A device with no link light may have a cabling, power or port problem. A working link but wrong VLAN may permit local link operation while preventing expected IP services. Intermittent packet loss may indicate errors, duplex mismatch, wireless interference or an unstable topology. One-way or selective reachability often suggests a VLAN, trunk-allowed-list, routing or firewall problem.

Useful verification information includes MAC address tables, VLAN summaries, trunk status, spanning-tree status, LACP member state, interface error counters, DHCP leases, AP association records and authenticated-user logs. Configuration backups and change control are essential in professional environments.

8. Applied Case: Illustrative Campus LAN Upgrade

Background

A fictional technical college has two floors, 180 students, administrative staff, IP telephones, security cameras and guest Wi-Fi. The existing flat network suffers from broadcast noise, accidental loops and unrestricted guest access to internal printers.

Problem Analysis

The network team identifies four major issues: all devices share one broadcast domain; guest users are on the same subnet as staff; unmanaged switches have been connected to wall outlets; and several APs use overlapping channels. There is no documented root bridge or switch management VLAN.

Approach and Solution

The team installs managed access switches with redundant fibre uplinks to a distribution pair. VLAN 10 is assigned to administration, VLAN 20 to laboratories, VLAN 30 to voice, VLAN 40 to guests and VLAN 99 to management. Access ports are explicitly assigned, while uplinks are configured as restricted 802.1Q trunks.

The distribution switch pair is selected as the intentional spanning-tree root arrangement. RSTP is enabled, edge protection is applied to user ports, and BPDU Guard is activated on those ports. Two physical uplinks are combined using LACP where compatible. Inter-VLAN routing occurs on the distribution layer, with firewall rules preventing guest access to internal networks.

APs broadcast staff and guest SSIDs. Staff access uses WPA2- or WPA3-Enterprise with RADIUS; guest access uses a separate VLAN and captive-portal policy. A radio survey is used to select channels and appropriate transmit power.

Outcome

Broadcast traffic is contained, guest traffic is separated, redundant links are available without creating loops, and failures can be diagnosed using documented VLAN, trunk and authentication records. The design also provides a manageable path for future APs and cameras.

Learning Points

Segmentation is most effective when VLAN design, routing policy, wireless authentication, physical security and monitoring are treated as one system. Redundancy without loop prevention is dangerous, and wireless performance depends on radio planning rather than advertised speed alone.

9. Limitations, Governance and Contemporary Practice

Ethernet and Wi-Fi are mature but not risk-free. VLANs do not encrypt traffic, MAC filtering is weak as an authentication method, and wireless coverage maps do not guarantee application performance. Switches and APs are operational technology and must be patched, monitored and protected from unauthorized physical access.

Organizations should establish approved configuration standards, least-privilege administration, secure management protocols, configuration backup, logging, time synchronization, vulnerability management and incident procedures. Network access control can evaluate device identity or posture before assigning a device to an appropriate VLAN, but it requires careful integration and exception handling.

Contemporary networks increasingly use controller-based WLAN management, cloud monitoring, software-defined access, multi-gigabit access ports, Wi-Fi 6/6E and Wi-Fi 7 capabilities, network automation and telemetry. These technologies improve visibility and capacity but introduce dependence on centralized platforms, licensing, accurate inventories and secure APIs. Automation should be tested, version-controlled and constrained by change approval.

Best-Practice Checklist

• Use managed switches and documented physical topology.
• Assign VLANs deliberately and limit trunk VLANs.
• Separate management, users, voice, IoT and guest traffic where justified.
• Select and document the spanning-tree root.
• Use RSTP and protect edge ports with suitable safeguards.
• Use LACP only with compatible member links.
• Prefer enterprise wireless authentication for organizational networks.
• Use unique, strong personal-network passphrases where enterprise authentication is impractical.
• Disable unused ports and insecure management protocols.
• Monitor errors, topology changes, rogue devices and authentication events.
• Test failover and restore configurations before an outage occurs.

Chapter Summary

Ethernet provides frame-based local communication using MAC addresses, switches and physical media. Switches learn source addresses and forward known unicast frames selectively, while broadcasts and unknown destinations are flooded within a VLAN. VLANs create logical broadcast domains, and 802.1Q trunks carry multiple VLANs between infrastructure devices. Routing is required for communication between VLANs.

Redundant Layer 2 links require Spanning Tree or an equivalent loop-prevention mechanism. RSTP improves convergence, while LACP combines compatible links for aggregate capacity and resilience. Wi-Fi uses shared radio channels and CSMA/CA, so capacity depends on interference, contention, channel planning and client density. Secure WLAN design uses modern encryption, strong authentication, segmentation and monitoring. Professional implementation combines correct configuration with documentation, governance, testing and ongoing maintenance.

Key Terms

MAC address: Data-link identifier assigned to a network interface.

Ethernet: IEEE 802.3 family of wired LAN technologies.

Frame: Data-link unit containing addresses, payload and error-detection information.

FCS: Frame Check Sequence used to detect transmission errors.

Switch: Multiport bridge that forwards frames using a MAC address table.

MAC address table: Mapping of learned MAC addresses to switch ports and VLANs.

VLAN: Logical Layer 2 broadcast domain.

Access port: Switch port assigned to an end-device VLAN.

Trunk: Link carrying traffic for multiple VLANs.

802.1Q: IEEE VLAN tagging method.

Native VLAN: VLAN whose frames may be sent untagged on a trunk.

Broadcast domain: Set of devices receiving a Layer 2 broadcast.

STP: Protocol that prevents Layer 2 loops by blocking redundant paths.

RSTP: Faster-converging form of spanning tree.

BPDU: Control frame used by spanning-tree protocols.

LACP: Protocol for negotiating link aggregation.

WLAN: Wireless local area network.

SSID: Wireless network name.

BSSID: Identifier of a particular wireless basic service set.

WPA3: Modern Wi-Fi security framework supporting stronger protection and authentication.

Review Questions

Short Answer Questions

1. What information does a switch learn from the source address of an incoming frame?
2. Distinguish an access port from a trunk port.
3. Why is routing required between two VLANs?
4. What problem does Spanning Tree Protocol solve?
5. Why is wireless throughput usually lower than the advertised physical rate?

Long Answer Questions

1. Explain Ethernet frame fields and the purpose of the FCS.
2. Describe how a switch handles known unicast, unknown unicast and broadcast frames.
3. Explain VLAN operation, 802.1Q tagging and the risks of native VLAN mismatch.
4. Compare traditional STP, RSTP and link aggregation in a redundant network design.
5. Explain a secure enterprise WLAN architecture using SSIDs, VLANs, 802.1X and RADIUS.

Analytical / Application Questions

1. A college wants staff, laboratory, voice and guest devices to share switches but remain logically separated. Design the VLAN, trunking and inter-VLAN routing approach, including two security controls.
2. Users report intermittent connectivity after an unmanaged switch is connected to two wall outlets. Identify the likely cause, the verification evidence you would collect and a safe corrective action.
3. An AP has strong signal strength but poor performance during examinations. Analyze at least four possible causes and propose a measurement-based improvement plan.

Multiple Choice Questions with Answers

Question 1

Which address does a switch normally learn from an incoming Ethernet frame?

A. The destination IP address

B. The source MAC address

C. The default gateway address

D. The destination port number

Correct Answer: B. The source MAC address

Question 2

What is the primary purpose of a VLAN?

A. To increase cable length

B. To encrypt every Ethernet frame

C. To create a logical Layer 2 broadcast domain

D. To replace all routing functions

Correct Answer: C. To create a logical Layer 2 broadcast domain

Question 3

Which device is required for communication between separate VLANs?

A. A repeater

B. A hub

C. A Layer 3 router or multilayer switch

D. A passive patch panel

Correct Answer: C. A Layer 3 router or multilayer switch

Question 4

What does a trunk link normally carry?

A. Traffic from exactly one end device only

B. Traffic for multiple VLANs

C. Only broadcast traffic

D. Only wireless management frames

Correct Answer: B. Traffic for multiple VLANs

Question 5

What is the main purpose of Spanning Tree Protocol?

A. To assign IP addresses

B. To prevent Layer 2 switching loops

C. To encrypt wireless traffic

D. To increase radio transmit power

Correct Answer: B. To prevent Layer 2 switching loops

Question 6

Which protocol is commonly used to negotiate link aggregation?

A. LACP

B. DHCP

C. DNS

D. ARP

Correct Answer: A. LACP

Question 7

Which Wi-Fi security approach is most appropriate for an organization requiring individual user authentication?

A. WEP with a shared key

B. Open authentication

C. WPA2- or WPA3-Enterprise with 802.1X

D. MAC filtering alone

Correct Answer: C. WPA2- or WPA3-Enterprise with 802.1X

Question 8

What happens when a switch receives a frame with an unknown unicast destination in a VLAN?

A. It routes the frame to another IP subnet

B. It floods the frame within that VLAN, excluding the incoming port

C. It always discards the frame

D. It sends the frame only to the default gateway

Correct Answer: B. It floods the frame within that VLAN, excluding the incoming port

Question 9

Why can a single flow fail to use the full combined bandwidth of an LACP bundle?

A. A single flow is commonly assigned to one member link by hashing

B. LACP disables full-duplex operation

C. VLANs prohibit all aggregation

D. FCS removes half of the bandwidth

Correct Answer: A. A single flow is commonly assigned to one member link by hashing

Question 10

Which statement about a wireless SSID is correct?

A. It is the physical cable identifier

B. It is the name used to identify a WLAN service

C. It is always identical to the client’s IP address

D. It provides encryption without authentication

Correct Answer: B. It is the name used to identify a WLAN service