Data Link Control and Medium Access

Introduction

The data link layer provides reliable and organized communication between directly connected nodes. It accepts a network-layer packet, places it into a frame, controls access to a shared medium, detects or sometimes corrects errors, and uses local addressing to deliver the frame to the appropriate interface. In the OSI reference model it is Layer 2; in the Internet model its functions are commonly associated with the link layer.

A data link is not merely a cable or radio channel. It is a set of rules that determines how bits are grouped, how senders identify receivers, how simultaneous transmissions are handled, and how a receiving device determines whether a frame is valid. These functions are essential in Ethernet networks, wireless LANs, point-to-point links, industrial systems, and wide-area access technologies.

At the bachelor level, it is important to distinguish three related but different ideas:

• Framing organizes a bit stream into identifiable units.
• Data link control governs error detection, flow control, and reliable delivery where required.
• Medium access control determines which device may use a shared channel and when.

Learning objectives

After studying this chapter, you should be able to:

1. Explain framing methods and the role of physical and logical addresses.
2. Compare error-detection and link-control techniques.
3. Distinguish contention-based, controlled-access, and channelization methods.
4. Explain Ethernet operation, switching, forwarding, and VLANs.
5. Describe why wireless networks require special medium-access mechanisms.
6. Analyze practical link-layer design choices, limitations, and security implications.

1. Framing: Turning Bits into Manageable Units

The physical layer delivers a sequence of bits. Without boundaries, a receiver cannot know where one message ends and the next begins. Framing solves this problem by adding structure around a network-layer packet. A frame normally contains a header, payload, and trailer.

A simplified frame can be represented as:

Figure: General structure of a data-link frame. Actual fields differ among protocols.

1.1 Character- and byte-oriented framing

Early protocols treated a frame as a sequence of characters. Special control characters indicated the beginning and end of a frame. If a control character appeared in the payload, the sender inserted an escape character; this process is called byte stuffing. The receiver removes the inserted escape character before delivering the payload.

Byte-oriented framing is simple when data is naturally represented as bytes. Its limitation is that the protocol must reserve special byte values or use an escape mechanism. Binary data can therefore increase the frame size slightly.

1.2 Bit-oriented framing

Bit-oriented protocols identify a frame with a special bit pattern, often called a flag. If that pattern occurs in the payload, the sender inserts an extra bit according to a rule known as bit stuffing. The receiver reverses the process.

For example, in a protocol using five consecutive 1s as a reserved sequence, the sender inserts a 0 after every sequence of five 1s in the data. The receiver removes that 0. Bit stuffing allows arbitrary payload data while preserving frame boundaries, although it creates variable overhead.

1.3 Length-based framing

A length field specifies the number of bytes or octets in the frame. The receiver reads the length and identifies the boundary mathematically. This method is efficient, but corruption in the length field can cause the receiver to lose synchronization. Robust protocols combine length information with an error-detection field and resynchronization rules.

1.4 Ethernet framing

An Ethernet frame contains destination and source MAC addresses, a type or length field, a payload, and a frame check sequence. Ethernet also uses a preamble and start-of-frame delimiter at the physical interface. The exact minimum and maximum frame sizes depend on the Ethernet variant and whether tags are present, but the central principle is stable: a frame carries local addresses and an integrity check around a network-layer packet.

2. Addressing at the Data Link Layer

Addressing must be interpreted in layers. A physical address, usually called a MAC address, identifies a network interface on a local link. A logical address, such as an IP address, identifies an interface within an internetworking scheme and supports routing across multiple links.

2.1 MAC addresses

An Ethernet MAC address is traditionally 48 bits, commonly written as six hexadecimal octets, such as 00:1A:2B:3C:4D:5E. The address is used for local delivery. A switch examines the destination MAC address and selects an outgoing port. It does not normally route a packet based on the MAC address across different IP networks.

Important MAC delivery types include:

• Unicast: one destination interface.
• Broadcast: all stations in the local broadcast domain; Ethernet uses FF:FF:FF:FF:FF:FF.
• Multicast: a selected group of interfaces.

MAC addresses can be factory-assigned, locally administered, randomized for privacy, or configured by an administrator. Consequently, a MAC address should not automatically be treated as a permanent proof of identity.

2.2 Logical addresses and encapsulation

An IP packet may travel through several links. At each hop, it is placed into a new data-link frame with new source and destination MAC addresses. The IP source and destination generally remain unchanged during ordinary forwarding, although network address translation can modify them at a boundary.

For example, a laptop sending to a web server first places the IP packet into a wireless frame addressed to the local access point. The access point or router removes that frame and creates another frame for the next link. Thus, logical addressing supports end-to-end routing, while physical addressing supports one-hop delivery.

2.3 Address resolution

When a host knows an IPv4 destination on the local network but does not know its MAC address, it can use Address Resolution Protocol (ARP). ARP broadcasts a request and receives a reply containing the relevant MAC address. IPv6 uses Neighbor Discovery Protocol, implemented through ICMPv6, rather than ARP.

Address-resolution systems introduce security concerns. An attacker may send false ARP replies, redirecting traffic through the attacker’s device. This is known as ARP spoofing or ARP poisoning. Switch features such as DHCP snooping and Dynamic ARP Inspection can reduce this risk, although secure end-to-end protocols remain important.

3. Error Detection and Link Reliability

Noise, interference, attenuation, and hardware faults can alter transmitted bits. A receiver therefore needs a method of deciding whether a frame is probably intact.

3.1 Parity and checksums

A parity bit makes the number of 1 bits even or odd. It detects any odd number of bit errors in the protected group, but it cannot detect every even number of errors. A checksum divides data into fixed-size words and adds them using a defined arithmetic rule. Checksums are inexpensive, but their error-detection strength depends on the construction and error pattern.

3.2 Cyclic redundancy check

Ethernet and many other link protocols use a cyclic redundancy check (CRC). The bit string is treated as a polynomial over binary arithmetic, where addition is equivalent to exclusive OR. The sender divides the data polynomial by a generator polynomial and appends the remainder. The receiver performs the same division. A nonzero remainder indicates that the frame is corrupted.

A simplified CRC relationship is:

where M(x) is the message polynomial, G(x) is the generator polynomial of degree r, R(x) is the remainder with degree less than r, and T(x) is the transmitted polynomial. In practice, the exact initial value, bit order, reflection convention, and final XOR are part of the protocol specification.

CRC is not encryption and does not prove that a frame came from a trustworthy sender. It is an integrity check against accidental corruption. An attacker who can modify both data and CRC may evade it.

3.3 Error correction and retransmission

A protocol may respond to errors by correcting them at the receiver or by requesting retransmission. Forward error correction (FEC) adds enough redundancy for the receiver to infer the original data without a retransmission. It is useful where retransmission is expensive, such as wireless or satellite links.

Automatic repeat request (ARQ) uses acknowledgements, sequence numbers, timers, and retransmissions. Common forms include:

• Stop-and-wait ARQ: one frame is sent and the sender waits for an acknowledgement.
• Go-back-N: several frames may be outstanding, but an error can cause retransmission from the erroneous frame onward.
• Selective repeat: only missing or damaged frames are retransmitted.

ARQ requires duplicate detection. If an acknowledgement is lost, a sender may retransmit a correctly received frame; sequence numbers allow the receiver to discard the duplicate while acknowledging it again.

4. Flow Control and Link Protocols

Flow control prevents a fast sender from overwhelming a slower receiver. It is distinct from congestion control, which responds to overload within a network. A receiver may advertise available buffer capacity, or a sender may use a sliding window limiting the amount of unacknowledged data.

In a sliding-window protocol, the sender may transmit several frames before receiving acknowledgements. If the window size is W frames and each frame carries L bits, the maximum amount of unacknowledged data is W L bits. This is a capacity relationship, not a guarantee of throughput; propagation delay, processing time, losses, and receiver limitations also matter.

A useful idealized condition for keeping a link busy is:

where W is the window size, T_f is frame transmission time, T_p is one-way propagation delay, and T_a is acknowledgement transmission and processing time. The approximation assumes a simple stop-and-wait-style acknowledgement path and ignores queueing and retransmission. Real protocols use more detailed timing models.

Point-to-point protocols such as HDLC and PPP illustrate link control. PPP supports framing, link establishment, authentication options, and network-layer protocol configuration. It is designed for a direct link rather than a multiaccess shared LAN.

5. Medium Access Control

When several devices share one physical medium, a rule is required to decide who transmits. The medium-access-control sublayer addresses this problem. Three broad families are useful for comparison.

5.1 Contention-based access

In contention systems, stations compete for access. A station transmits when it believes the channel is available. Collisions may occur, so the protocol must detect, avoid, or recover from them.

#### ALOHA and slotted ALOHA

Pure ALOHA permits transmission at any time. If two frames overlap, both may be damaged and retransmitted after random delays. Slotted ALOHA restricts transmissions to time slots, reducing the vulnerable period and improving maximum theoretical efficiency. These methods are historically important and illustrate the trade-off between simplicity and collision probability.

#### CSMA/CD

Carrier Sense Multiple Access with Collision Detection was used by traditional shared, half-duplex Ethernet. A station listened before transmitting, monitored the medium during transmission, and stopped if it detected a collision. It then waited for a random backoff interval before retrying. The binary exponential backoff increased the possible waiting range after repeated collisions.

Modern switched full-duplex Ethernet normally has no collisions, so CSMA/CD is not used on those links. Confusing historical shared Ethernet with contemporary switched Ethernet leads to incorrect network designs.

#### CSMA/CA

Wireless stations generally cannot reliably detect collisions while transmitting. They use Carrier Sense Multiple Access with Collision Avoidance. A station waits for an idle interval, selects a random contention window, and counts down while the channel remains idle. It transmits when the counter reaches zero. An acknowledgement confirms reception; failure causes a larger contention window.

The optional RTS/CTS exchange can reduce hidden-terminal collisions. However, it adds overhead and is not automatically beneficial for every traffic pattern.

5.2 Controlled access

Controlled-access systems arrange transmission opportunities rather than leaving all stations to compete. Polling gives a central controller responsibility for inviting stations to transmit. It can provide predictable service but introduces controller overhead and a single point of failure.

Token passing circulates a control token. Only the station holding the token may transmit. Token systems can provide bounded access delay under suitable assumptions, but token loss, duplication, or node failure requires recovery procedures.

5.3 Channelization

Channelization divides a medium among users. Frequency-division multiple access assigns frequency bands; time-division multiple access assigns time slots; code-division methods assign codes. Modern wireless systems may combine time, frequency, code, and spatial dimensions. Channelization reduces direct contention but requires synchronization, planning, and management of unused capacity.

6. Ethernet Switching

A hub repeats incoming signals to all ports. A switch, in contrast, makes forwarding decisions per port and per frame. This improves scalability, reduces unnecessary traffic, and allows simultaneous conversations.

6.1 Learning and forwarding

A switch builds a MAC address table by examining the source MAC address of incoming frames. It associates that address with the receiving port. For a destination address, the switch typically:

1. Forwards the frame only through the known destination port if the address is in the table.
2. Floods the frame out all appropriate ports, except the incoming port, if the destination is unknown.
3. Floods broadcast frames within the relevant broadcast domain.
4. Filters a frame when the destination is known to be on the same incoming port.

Entries age out because devices move, ports change, and temporary information becomes stale. Switching may use store-and-forward operation, which checks the complete frame before forwarding, or cut-through techniques, which begin forwarding earlier but may propagate corrupted frames.

6.2 Collision and broadcast domains

Each switch port normally forms a separate collision domain. Full-duplex operation eliminates the need for collision detection on that link. A VLAN or Layer 3 boundary, rather than a switch alone, determines the scope of a broadcast domain.

Loops are dangerous because Ethernet frames do not contain a general hop limit comparable to an IP packet’s TTL. A switching loop can create persistent broadcast storms and multiple-frame circulation. Spanning Tree Protocol (STP) and its variants logically block redundant paths while preserving them for failover.

7. VLANs and Logical Segmentation

A Virtual LAN (VLAN) creates a logical Layer 2 broadcast domain independent of the physical location of attached devices. VLANs can separate departments, device types, security zones, or operational functions.

An access port normally carries traffic for one VLAN to an endpoint. A trunk port carries traffic for multiple VLANs between switches, access points, or routers. IEEE 802.1Q tagging inserts a VLAN identifier into the Ethernet frame. The tag is generally removed before delivery through an ordinary access port.

A VLAN improves organization and limits broadcast scope, but it is not automatically a complete security boundary. Misconfigured trunks, unauthorized tagging, weak switch administration, or routing policies can defeat intended isolation. Inter-VLAN communication requires a Layer 3 device, such as a router or multilayer switch, where access-control rules can be applied.

Illustrative VLAN design

Consider a university laboratory with staff computers, student computers, voice devices, and building-management sensors. A sensible initial design may assign separate VLANs to these categories. The switch configuration then restricts which VLANs may cross trunks, while a firewall or multilayer switch controls permitted communication between them. The design should include management access through a dedicated management VLAN, authenticated administrator accounts, logging, and a documented recovery procedure.

Segmentation should be based on actual trust and traffic requirements rather than department names alone. A device in a “staff” VLAN is not automatically trustworthy; compromised endpoints remain possible.

8. Wireless Medium Access

Wireless communication differs from wired Ethernet because radio signals are shared through space, stations may be mobile, signal strength varies, and a transmitter may not hear another transmitter. These conditions create the hidden-terminal and exposed-terminal problems.

• Hidden terminal: two stations cannot hear one another but can both reach an access point. They may transmit simultaneously.
• Exposed terminal: a station hears a nearby transmission and unnecessarily defers even though its own transmission would not interfere with the intended receiver.

Wi-Fi uses CSMA/CA with interframe spaces, random backoff, acknowledgements, and retransmission. It may use RTS/CTS to reserve the medium. Modern WLANs also use scheduled access, beamforming, multiple antennas, and coordinated resource allocation. These improvements do not eliminate the need for sound channel planning and security.

Wireless efficiency is affected by distance, modulation and coding, interference, channel width, competing networks, and the number of active stations. The advertised physical rate is not equal to application throughput because headers, contention, acknowledgements, encryption processing, retransmissions, and protocol overhead consume capacity.

Wireless security should use current enterprise-grade authentication and encryption, strong administrative credentials, protected management interfaces, and network monitoring. A hidden SSID is not a security control: it does not prevent discovery by a capable observer.

9. Worked Application: Designing a Reliable Campus Link

Background

A fictional university operates a three-building campus. The original network uses a mixture of unmanaged switches, wireless access points, and flat addressing. Users report slow access during class changes, printers are visible to many users, and occasional loops disable a building.

Problem analysis

The symptoms suggest several Layer 2 issues:

• A flat broadcast domain creates unnecessary broadcast and discovery traffic.
• Unmanaged switches provide no reliable loop prevention or monitoring.
• Wireless contention increases when many students associate with one access point.
• Printer and management devices are reachable from more systems than necessary.
• A physical topology diagram and MAC-address inventory are incomplete.

The problem is not solved simply by purchasing a faster Internet connection. Local contention, broadcast scope, and switching loops can remain inside the campus.

Approach and solution

The network team designs separate VLANs for students, staff, voice, printers, building systems, guests, and network management. Managed switches are installed with redundant uplinks controlled by Rapid Spanning Tree Protocol. Trunks are restricted to required VLANs, and unused ports are disabled or placed in an isolated state.

A multilayer switch applies inter-VLAN access rules. Guest traffic is sent only to the Internet. Student devices cannot directly administer switches or reach building-control systems. Printers are reachable through controlled services rather than unrestricted Layer 2 visibility.

Wireless access points are distributed after a site survey. Channels and transmit power are planned to reduce co-channel interference. High-density classrooms receive additional capacity. Enterprise authentication is configured, and management traffic is isolated.

Monitoring records interface errors, broadcast rates, loop events, authentication failures, and access-point utilization. Change control requires a tested configuration backup and a rollback plan.

Outcome

The redesigned network reduces broadcast scope, prevents common switching loops, improves fault localization, and limits unnecessary access between device groups. Wireless performance improves because capacity is distributed and channels are planned. The solution does not guarantee perfect performance: radio interference, endpoint malware, configuration errors, and peak demand still require continuous management.

Learning points

1. Link-layer problems often appear as application slowness.
2. VLANs organize traffic but require Layer 3 policy for secure communication control.
3. Redundancy without loop prevention can reduce availability.
4. Wireless capacity depends on contention and radio conditions, not only advertised speed.
5. Documentation, monitoring, and recovery planning are part of technical design.

10. Limitations, Governance, and Contemporary Practice

Layer 2 protocols are efficient because they operate close to the medium, but that closeness creates limitations. MAC tables can be attacked through flooding. ARP and Neighbor Discovery can be abused for redirection. VLAN hopping can result from poor trunk configuration. Broadcast storms can consume capacity rapidly. Wireless networks are exposed to interference and unauthorized association attempts.

Best practices include:

• Use managed switches and maintain current topology documentation.
• Apply least privilege to switch, router, and access-point administration.
• Restrict trunk VLANs and explicitly configure native or untagged traffic.
• Enable loop protection, storm control, port security, and appropriate spanning-tree safeguards.
• Segment systems according to trust, risk, and communication requirements.
• Monitor errors, utilization, MAC movements, authentication events, and configuration changes.
• Use strong wireless authentication and modern encryption.
• Test failover and retain secure configuration backups.
• Treat MAC addresses and device fingerprints as identifiers, not absolute identities.
• Consider privacy when collecting wireless association logs and endpoint information.

Contemporary networks increasingly combine Ethernet switching, software-defined networking, cloud-managed WLANs, virtual overlays, and zero-trust access policies. Automation can detect anomalous MAC movements or unusual broadcast levels, but automated remediation must be governed carefully. A machine-learning system may identify deviations from normal traffic; it should not be trusted blindly to isolate critical medical, industrial, or safety systems without validation and human oversight.

Chapter Summary

The data link layer transforms network-layer packets into frames and provides local delivery across a directly connected medium. Framing establishes boundaries through length fields, byte stuffing, bit stuffing, or protocol-specific structures. MAC addresses support one-hop physical delivery, whereas logical addresses support routing across multiple links.

Error detection methods such as parity, checksums, and CRC identify accidental corruption. Reliable link protocols may use acknowledgements, timers, sequence numbers, sliding windows, and retransmission. Flow control protects receivers from overload, while ARQ and FEC address different reliability requirements.

Medium access may be contention-based, controlled, or channelized. CSMA/CD belongs mainly to historical shared Ethernet; modern switched Ethernet is generally full duplex. Wireless LANs use CSMA/CA because collision detection is difficult during radio transmission and because hidden terminals can exist.

Switches learn source MAC addresses and forward frames according to destination information. VLANs create logical broadcast domains, but secure communication between VLANs requires Layer 3 policy and careful configuration. Wireless performance depends on contention, interference, propagation, and protocol overhead. Effective link-layer engineering therefore combines protocol knowledge with segmentation, monitoring, security, documentation, and operational governance.

Key Terms

ARQ: Automatic Repeat Request; a reliability method using acknowledgements and retransmissions.

Broadcast domain: The set of devices that receive a Layer 2 broadcast.

CRC: Cyclic Redundancy Check; a polynomial-based error-detection technique.

CSMA/CA: Carrier Sense Multiple Access with Collision Avoidance, used commonly in wireless LANs.

CSMA/CD: Carrier Sense Multiple Access with Collision Detection, used in traditional shared Ethernet.

Data link layer: The layer responsible for framing, local addressing, link control, and medium access.

FEC: Forward Error Correction; redundancy that permits correction without retransmission.

Frame: The data unit exchanged by a data-link protocol.

Framing: The process of identifying the beginning and end of a data-link unit.

MAC address: A local interface address used for data-link delivery.

Medium access control: Rules governing use of a shared communication medium.

Polling: Controlled access in which a controller grants stations permission to transmit.

Sliding window: A flow-control and reliability technique allowing multiple outstanding frames.

Spanning Tree Protocol: A family of protocols that prevents Layer 2 forwarding loops.

Switch: A device that forwards frames selectively using a MAC-address table.

Token passing: Controlled access in which possession of a token grants transmission permission.

Trunk port: A link that carries traffic for multiple VLANs.

VLAN: Virtual LAN; a logical Layer 2 broadcast domain.

VLAN tag: A field identifying a VLAN, commonly specified by IEEE 802.1Q.

Review Questions

Short Answer Questions

1. What problem does framing solve in data communication?
2. How does a MAC address differ from an IP address?
3. What is the purpose of a CRC field?
4. Why is CSMA/CD generally not needed on modern full-duplex switched Ethernet?
5. What is the difference between an access port and a trunk port?

Long Answer Questions

1. Explain byte stuffing, bit stuffing, and length-based framing. Compare their advantages and limitations.
2. Describe stop-and-wait, go-back-N, and selective-repeat ARQ, including the role of acknowledgements and sequence numbers.
3. Explain how an Ethernet switch learns MAC addresses and handles known, unknown, broadcast, and same-port destinations.
4. Compare contention-based, controlled-access, and channelization techniques using practical examples.
5. Explain how VLANs, inter-VLAN routing, and spanning-tree mechanisms contribute to a manageable campus network.

Analytical / Application Questions

1. A company has frequent broadcast storms after adding redundant switch links. Analyze the likely Layer 2 cause and propose a technically justified corrective design.
2. A wireless classroom has poor performance even though the access point advertises a high physical data rate. Identify at least five possible causes and explain how each could be investigated.
3. Design a basic link-layer architecture for a hospital containing staff devices, guest devices, medical equipment, voice endpoints, printers, and building-control systems. Justify your segmentation, access-control, monitoring, and recovery decisions.

Multiple Choice Questions with Answers

Question 1

Which function is primarily performed by the data link layer?

A. End-to-end route selection across multiple networks

B. Framing and local delivery over a directly connected link

C. Conversion of analog signals into electrical pulses

D. Presentation-layer data compression

Correct Answer: B. Framing and local delivery over a directly connected link

Question 2

What does a switch normally learn from the source address of an incoming Ethernet frame?

A. The IP route to the Internet

B. The encryption key of the sender

C. The source MAC address and its incoming port

D. The application protocol used by the payload

Correct Answer: C. The source MAC address and its incoming port

Question 3

What is the main purpose of a CRC in an Ethernet frame?

A. To encrypt the payload

B. To identify the next-hop router

C. To detect accidental transmission errors

D. To assign a VLAN to the frame

Correct Answer: C. To detect accidental transmission errors

Question 4

Why does a wireless LAN generally use CSMA/CA rather than CSMA/CD?

A. Wireless frames do not contain addresses

B. A wireless transmitter usually cannot reliably detect a collision while transmitting

C. Wireless networks never experience interference

D. CSMA/CA eliminates all retransmissions

Correct Answer: B. A wireless transmitter usually cannot reliably detect a collision while transmitting

Question 5

Which statement best describes a VLAN?

A. A physical cable dedicated to one workstation

B. A logical Layer 2 broadcast domain

C. A replacement for an IP address

D. A protocol that encrypts every Ethernet frame

Correct Answer: B. A logical Layer 2 broadcast domain

Question 6

What does a switch commonly do when it receives a frame whose destination MAC address is unknown?

A. Discard it immediately

B. Route it using the destination IP address

C. Flood it through appropriate ports except the incoming port

D. Change the destination MAC address to broadcast permanently

Correct Answer: C. Flood it through appropriate ports except the incoming port

Question 7

Which ARQ method retransmits only specifically missing or damaged frames?

A. Selective repeat

B. Pure ALOHA

C. Polling

D. Token passing

Correct Answer: A. Selective repeat

Question 8

What is the principal purpose of Spanning Tree Protocol?

A. To increase the physical length of an Ethernet cable

B. To prevent Layer 2 forwarding loops

C. To translate IPv4 addresses into IPv6 addresses

D. To assign wireless radio frequencies

Correct Answer: B. To prevent Layer 2 forwarding loops

Question 9

A trunk port is primarily used to carry:

A. Only untagged traffic from one endpoint

B. Traffic belonging to multiple VLANs

C. Only broadcast frames

D. Only encrypted wireless management frames

Correct Answer: B. Traffic belonging to multiple VLANs

Question 10

Which situation illustrates a hidden-terminal problem?

A. A switch knows the destination MAC address

B. Two wireless stations cannot hear each other but both transmit to the same access point

C. A router has two equal-cost IP routes

D. A host receives a duplicate frame with the same sequence number

Correct Answer: B. Two wireless stations cannot hear each other but both transmit to the same access point