Ethernet, LAN Switching and Wireless Networks

Introduction and Context

Ethernet and Wi-Fi are the dominant technologies used to connect devices within homes, campuses, enterprises and industrial environments. Ethernet provides reliable wired communication through frames, Media Access Control (MAC) addressing and switches. Wireless LANs extend similar local-network services through radio transmission, access points and mobility mechanisms.

A modern LAN is not simply a collection of cables and computers. It is a designed system that must provide efficient forwarding, logical separation, resilience, security, manageability and adequate performance. This chapter explains how Ethernet networks operate, how switches learn and forward frames, and how VLANs, trunks and loop-prevention protocols support scalable designs. It then evaluates Wi-Fi standards, access-point placement, mobility, interference and wireless security.

Learning Objectives

By the end of this chapter, you should be able to:

• explain Ethernet framing and MAC addressing;
• describe how switches learn, filter and forward frames;
• design VLANs and configure access and trunk links;
• explain Layer 2 loops and the operation of Spanning Tree Protocol;
• compare major Wi-Fi generations and radio characteristics;
• plan access-point placement and channel use;
• distinguish roaming, association and authentication;
• evaluate wireless interference, capacity and security;
• troubleshoot common wired and wireless LAN faults.

1. Ethernet Foundations

Ethernet is defined primarily by the IEEE 802.3 family of standards. It operates at the physical layer and data-link layer of the OSI model. The physical layer specifies media, signalling and data rates; the data-link layer defines Ethernet frames, MAC addressing and medium access behaviour.

1.1 Ethernet frames

An Ethernet frame normally contains the following fields:

The standard Ethernet payload is generally 46 to 1500 bytes, producing a minimum frame size of 64 bytes from destination address through FCS. The minimum protects collision-detection assumptions in traditional shared Ethernet. Modern switched full-duplex Ethernet does not normally experience collisions, but the frame format remains compatible with the standard.

The FCS detects corruption; it does not correct the error. A frame failing the check is discarded, and recovery is normally performed by a higher-layer protocol such as TCP.

1.2 MAC addresses

A MAC address is a link-layer identifier, usually 48 bits long and represented as six hexadecimal octets, such as 00:1A:2B:3C:4D:5E. The first 24 bits commonly identify the organizationally unique identifier assigned to a manufacturer, while the remaining bits identify an interface. However, modern operating systems frequently use locally administered and randomized MAC addresses, especially for Wi-Fi privacy.

The first bit of the first octet indicates whether an address is individual or group-oriented. An individual address identifies one interface; a group address may represent multicast recipients. The second bit indicates whether the address is globally administered or locally administered.

Important address types are:

• Unicast: one sender to one destination.
• Broadcast: all devices in the local broadcast domain; Ethernet uses FF:FF:FF:FF:FF:FF.
• Multicast: one sender to a subscribed group of receivers.

MAC addresses have local significance. Routers normally replace the Layer 2 header at each routed hop, so a destination MAC address is not an end-to-end Internet identifier.

2. Ethernet Switching

A switch is a multiport bridge that examines Ethernet frames and forwards them according to a MAC address table. Its principal operations are learning, forwarding, filtering and flooding.

When a frame arrives, the switch:

1. records the source MAC address against the incoming port and VLAN;
2. examines the destination MAC address;
3. forwards the frame through the appropriate port if the destination is known;
4. filters it if the destination is known to be on the incoming port;
5. floods it within the relevant VLAN if the destination is unknown, broadcast or an applicable multicast.

The table entry must include the VLAN because the same MAC address can theoretically appear in different logical networks. Entries age out after an inactivity period so that topology changes can be accommodated.

A switch does not ordinarily inspect the IP address when making a basic Layer 2 forwarding decision. Multilayer switches can also route between VLANs using IP information, but that is a separate function.

2.1 Collision and broadcast domains

Each switch port normally forms a separate collision domain. Full-duplex operation eliminates the need for devices to contend for a shared medium. A VLAN defines a broadcast domain: broadcasts are forwarded within the VLAN but are not normally forwarded into another VLAN without a router or Layer 3 switch.

Excessive broadcast traffic can consume bandwidth and processing capacity. VLAN design therefore has performance and security consequences, although VLANs should not be treated as a complete security boundary without additional controls.

2.2 Forwarding performance

Switches may use store-and-forward switching, which receives and checks the complete frame before forwarding, or cut-through techniques, which begin forwarding earlier. Store-and-forward provides stronger error isolation and supports ports with different speeds; cut-through can reduce latency but may propagate corrupted frames. Modern equipment may select techniques dynamically.

A useful capacity relationship is the offered traffic load:

Here, λ is the average frame arrival rate, μ is the service rate of the switch port, and ρ is the utilization ratio. Both rates must use the same unit, such as frames per second. The relationship is a planning indicator, not a complete queueing model. As utilization approaches 1, delay and queue loss can increase sharply, depending on buffering and traffic patterns.

3. VLANs and 802.1Q Trunking

A Virtual LAN (VLAN) logically separates devices even when they share physical switching infrastructure. For example, an organisation may create separate VLANs for administration, students, voice devices, servers and guests.

VLANs support:

• smaller broadcast domains;
• policy separation;
• simpler moves and changes;
• improved fault isolation;
• structured IP subnet allocation.

A VLAN is not automatically equivalent to a security zone. Inter-VLAN traffic passes through a Layer 3 device where access-control policies should be applied.

3.1 Access ports

An access port carries traffic for one VLAN toward an end device such as a workstation or printer. Frames transmitted to the endpoint are normally untagged. The switch associates arriving untagged frames with the configured access VLAN.

Access ports should be explicitly configured rather than relying on automatic negotiation. Unused ports should be disabled or assigned to an isolated parking VLAN.

3.2 Trunk ports

A trunk carries multiple VLANs between switches, a switch and a router, or a switch and a hypervisor. IEEE 802.1Q inserts a VLAN tag into the Ethernet frame. The tag identifies the VLAN and includes priority information for quality-of-service purposes.

A trunk should have:

• an explicitly defined list of permitted VLANs;
• matching native or untagged VLAN configuration at both ends;
• administrative restrictions that prevent unintended negotiation;
• documentation of its purpose and connected devices.

The native VLAN is the VLAN whose frames are transmitted without an 802.1Q tag on a trunk. Native VLAN mismatches can cause traffic leakage or connectivity faults. Using an unused, dedicated native VLAN and avoiding unnecessary untagged traffic is a common hardening practice.

3.3 Inter-VLAN routing

Devices in different VLANs require a Layer 3 gateway. Common designs include router-on-a-stick, in which one router interface uses multiple tagged subinterfaces, and a multilayer switch, in which switched virtual interfaces provide gateways for VLANs.

Each VLAN should normally map to a distinct IP subnet. For example:

A /24 IPv4 subnet contains 256 addresses, of which 254 are normally usable for hosts when the network and broadcast addresses are reserved. This convention applies to ordinary IPv4 subnetting; special-purpose addressing can alter practical availability.

Worked design example

A campus requires four logical groups: staff, students, voice and guests. The designer creates four VLANs and four corresponding IP subnets. Access ports connect end devices to their assigned VLANs. Trunks connect access switches to a distribution switch. The distribution switch supplies the default gateways and applies access-control lists. Guest traffic is permitted to reach the Internet but denied access to staff and server subnets.

The design succeeds because physical connectivity, logical segmentation and Layer 3 policy are treated as separate but coordinated decisions.

4. Layer 2 Loops and Loop Prevention

Redundant links improve availability but can create Layer 2 loops. Ethernet frames do not contain a reliable hop limit at Layer 2. A broadcast or unknown unicast can therefore circulate repeatedly, producing broadcast storms, duplicate frames and MAC-table instability.

4.1 Spanning Tree Protocol

Spanning Tree Protocol (STP), standardised in IEEE 802.1D, creates a logical loop-free tree while retaining physically redundant links. Switches exchange Bridge Protocol Data Units (BPDUs) and select:

• a root bridge;
• one root port on each non-root switch;
• designated ports for network segments;
• blocked or alternate ports that do not forward normal traffic.

The root bridge is selected using the lowest bridge ID, which combines bridge priority and MAC address. Administrators should configure the intended root explicitly rather than allowing an arbitrary switch to win through its MAC address.

Rapid Spanning Tree Protocol (RSTP), IEEE 802.1w, improves convergence by using faster port roles and handshakes. Multiple Spanning Tree Protocol (MSTP) maps groups of VLANs to spanning-tree instances, reducing control-plane overhead in larger networks.

4.2 Edge protection

A port connected to an end device can be configured as an edge or PortFast port so that it reaches forwarding state quickly. It should not be used on a switch-to-switch link. BPDU Guard can disable an edge port if a BPDU appears, protecting against accidental or malicious connection of another switch.

Other useful controls include Root Guard, Loop Guard, storm control and DHCP snooping. These mechanisms must be implemented according to the vendor’s operating model and tested before production deployment.

Figure: STP preserves physical redundancy while blocking one logical forwarding path.

5. Wireless LAN Principles

Wi-Fi is based on the IEEE 802.11 family. Unlike switched full-duplex Ethernet, wireless devices share a radio medium. They use Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA): a station listens, waits according to contention rules, transmits when the medium is available and may use acknowledgements and retransmission.

Wireless communication is affected by attenuation, reflection, refraction, diffraction and scattering. Signal strength decreases with distance and obstacles. Metal, reinforced concrete, water and dense human occupancy can significantly alter coverage.

5.1 Wi-Fi generations

Theoretical PHY rate is not the same as application throughput. Protocol overhead, contention, retransmissions, signal quality, channel width, client capability and backhaul capacity reduce usable performance.

A simplified planning relationship is:

R_PHY is the negotiated physical-layer rate in bit/s, η is the dimensionless efficiency factor between 0 and 1, and T_application is approximate application throughput in bit/s. This is an estimate, not a standards guarantee; efficiency varies with contention, frame aggregation, encryption, retransmission and traffic direction.

5.2 Bands and channels

The 2.4 GHz band generally provides greater range but fewer non-overlapping channels and more interference. The 5 GHz band offers more capacity and channels but usually has shorter range. The 6 GHz band can provide clean spectrum and wide channels where national regulation and device support permit it.

Channel width is a trade-off. Wider channels can increase peak rate but consume more spectrum and may reduce the number of independent channels available for neighbouring access points. In dense deployments, narrower channels often provide better aggregate capacity.

5.3 Access-point design

Access-point design begins with requirements rather than a coverage map alone. The designer should identify:

• number and type of clients;
• application traffic and latency needs;
• user density and simultaneous activity;
• building materials and floor layout;
• roaming requirements;
• regulatory limits and available channels;
• wired uplink capacity and power requirements.

Capacity planning is often more important than maximum range. A single access point may cover a room but become congested when many clients transmit simultaneously. A professional survey measures received signal strength, noise, channel utilization and, ideally, packet loss and application performance.

The signal-to-noise ratio is:

Both powers must be expressed in dBm. SNR is a difference in logarithmic units and is expressed in dB. Higher SNR generally supports more reliable modulation, but the required value depends on the selected data rate, implementation and environment.

APs should be positioned to provide overlapping coverage for roaming without creating excessive co-channel contention. Transmit power should not simply be set to maximum; clients may transmit at lower power, creating asymmetric links and sticky-client behaviour.

6. Mobility and Roaming

Association is the process by which a client joins an access point after discovering a wireless network. Authentication may refer to the 802.11 authentication exchange or, in enterprise systems, the stronger identity process performed through 802.1X and an authentication server.

Roaming occurs when a client moves from one access point to another within the same extended service set. The client usually makes the roaming decision, although controllers and standards can assist with information and signalling. Fast transition mechanisms such as 802.11r can reduce interruption, while 802.11k supplies neighbour information and 802.11v can support network-assisted transition decisions.

Good roaming requires consistent SSID, security policy, VLAN reachability, addressing and radio design. Excessively large cells, incompatible security settings or poor overlap can cause dropped sessions.

7. Wireless Security

The security hierarchy is commonly described as follows:

• Open networks: provide no confidentiality and should be treated as untrusted.
• WPA2-Personal: uses a pre-shared key and AES-based protection; suitable for small environments but vulnerable if the shared password is weak or widely distributed.
• WPA3-Personal: uses Simultaneous Authentication of Equals, improving resistance to offline password guessing.
• WPA2/WPA3-Enterprise: uses 802.1X and typically an Extensible Authentication Protocol method with a central authentication server. It supports individual identities, stronger lifecycle control and often dynamic VLAN assignment.

Security design should include certificate validation, least privilege, network segmentation, protected management interfaces, firmware updates, logging and incident response. Disabling SSID broadcast is not meaningful security because the network can still be discovered through protocol observations. MAC filtering is also weak because MAC addresses can be observed and spoofed.

Wireless security must protect availability as well as confidentiality. Rogue access points, evil-twin networks, deauthentication abuse, jamming and misconfigured guest access can compromise operations. Wireless intrusion detection and prevention can help, but they must be governed carefully because monitoring radio traffic may involve privacy and legal considerations.

8. Troubleshooting and Operational Practice

A structured troubleshooting method prevents random configuration changes:

1. define the symptom and scope;
2. determine whether the problem is physical, Layer 2, Layer 3, service-related or wireless-radio-related;
3. collect evidence such as interface counters, MAC tables, VLAN state, DHCP logs, authentication logs and wireless survey data;
4. form and test one hypothesis at a time;
5. apply the smallest safe change;
6. verify service and document the result.

Typical wired faults include incorrect VLAN assignment, trunk allowed-list errors, native VLAN mismatch, duplex or speed problems, disabled ports and loops. Typical wireless faults include poor signal, excessive co-channel contention, adjacent-channel interference, authentication failure, DHCP exhaustion, overloaded APs and incompatible client capabilities.

Monitoring should include link status, errors, utilization, broadcast rates, STP topology changes, AP client counts, channel utilization, authentication failures and rogue-device alerts. Configuration backups and change control are essential in enterprise environments.

Applied Case: Illustrative Campus LAN and Wi-Fi Deployment

Background

A fictional technical college has three buildings. Its original flat network uses one broadcast domain, shared wireless passwords and unmanaged access points. Users report slow Internet access, intermittent voice calls and unauthorised access to staff printers.

Problem analysis

A survey finds that broadcast traffic is excessive, several APs use overlapping channels, and the shared password has been distributed beyond the intended community. Switches have redundant links but no consistent STP priorities. Guest and staff devices share the same IP subnet.

Approach and solution

The network team creates staff, student, voice, server, management and guest VLANs. Access ports are assigned explicitly, while switch uplinks use restricted 802.1Q trunks. A multilayer switch provides gateways and applies ACLs. Guest traffic is routed only toward the Internet. The intended distribution switch is configured as the STP root, and edge-port protection is enabled.

A predictive and validation wireless survey guides AP placement. The design uses centrally managed APs, balanced transmit power, planned channel reuse and separate staff and guest SSIDs. Staff use WPA3-Enterprise with certificate validation; guests use a captive portal and Internet-only policy. AP uplinks receive suitable PoE and are monitored for utilization and authentication failures.

Outcome

Broadcast scope is reduced, voice traffic receives appropriate priority, guest devices cannot reach internal resources, and roaming becomes more reliable. The improvement is not attributed to one technology alone; it results from coordinated segmentation, loop prevention, radio planning, identity-based security and operational monitoring.

Learning points

A successful LAN design aligns physical topology, logical segmentation, addressing, security and management. Wireless performance must be evaluated by capacity and interference, not by signal strength alone. Redundancy is valuable only when control protocols prevent it from becoming a loop.

Challenges, Limitations and Governance

VLANs can become difficult to manage when names, subnets and policies are inconsistent. STP may converge more slowly than modern routed designs, and excessive Layer 2 extension increases failure domains. Wireless capacity is inherently shared and can be affected by neighbouring networks outside organisational control.

Regulatory requirements apply to radio spectrum, lawful interception, data protection and retention of authentication logs. Organisations should collect only necessary telemetry, restrict administrative access, protect credentials and define retention periods. Enterprise identity systems must also address account termination, certificate revocation and contractor access.

Automation and AI-assisted network management can detect anomalies, recommend channels or identify unusual traffic patterns. Such systems should remain subject to human review, explainable change approval, secure data handling and rollback procedures. An automated recommendation is not a substitute for engineering validation.

Best-Practice Checklist

• Use structured VLAN and IP-addressing plans.
• Restrict trunk VLANs and standardise native VLAN handling.
• Explicitly configure access ports and disable unused interfaces.
• Set STP root and backup-root priorities intentionally.
• Apply edge protection, BPDU Guard and storm-control policies where appropriate.
• Design Wi-Fi for capacity, roaming and application requirements.
• Prefer enterprise authentication for organisational networks.
• Validate certificates and protect management interfaces.
• Survey radio conditions and monitor after deployment.
• Document topology, configurations, exceptions and recovery procedures.

Chapter Summary

Ethernet transfers data in frames using MAC addresses, while switches learn source locations and forward traffic within VLAN-specific forwarding domains. VLANs provide logical segmentation, and 802.1Q trunks carry multiple VLANs between infrastructure devices. Inter-VLAN communication requires Layer 3 routing and should be controlled with explicit policies.

Redundant Layer 2 links can create loops, so STP, RSTP or MSTP must establish a loop-free logical topology. Edge protection and storm controls strengthen the design. Wi-Fi uses shared radio media, making channel planning, capacity, signal-to-noise ratio, client density and interference central design concerns. Wi-Fi generations improve efficiency through technologies such as MIMO, OFDMA and multi-link operation, but theoretical PHY rates do not equal application throughput.

Reliable wireless mobility depends on suitable coverage overlap, consistent security and addressing, and appropriate roaming support. WPA3 and enterprise 802.1X authentication provide stronger protection than open networks or shared passwords. Effective LAN engineering combines configuration accuracy, security governance, measurement, monitoring and disciplined troubleshooting.

Key Terms

Access port: A switch port assigned to one VLAN and normally carrying untagged end-device traffic.

802.1Q: IEEE standard for VLAN tagging on Ethernet frames.

Broadcast domain: The set of devices that receive a Layer 2 broadcast.

Collision domain: A network segment in which simultaneous transmission could produce a collision.

FCS: Frame Check Sequence used to detect frame corruption.

MAC address: A data-link identifier associated with a network interface.

Native VLAN: The VLAN whose trunk traffic is transmitted without an 802.1Q tag.

OFDMA: Orthogonal Frequency Division Multiple Access, used by Wi-Fi 6 to allocate portions of a channel to users.

RSTP: Rapid Spanning Tree Protocol for faster Layer 2 loop recovery.

SNR: Difference between received signal power and noise power, expressed in dB.

SSID: Service Set Identifier, the human-readable wireless network name.

STP: Spanning Tree Protocol for preventing Layer 2 forwarding loops.

Trunk: A link carrying traffic for multiple VLANs.

Unicast: Communication from one sender to one recipient.

VLAN: Virtual Local Area Network providing logical Layer 2 segmentation.

WPA3: A modern Wi-Fi security framework supporting stronger personal and enterprise authentication.

802.1X: Port-based access control commonly used with enterprise wireless authentication.

Co-channel interference: Contention caused by multiple networks using the same radio channel.

Review Questions

Short Answer Questions

1. What is the function of the Ethernet FCS?
2. How does a switch learn a MAC address?
3. What is the difference between an access port and a trunk port?
4. Why are Layer 2 loops dangerous?
5. Define SNR in the context of Wi-Fi.

Long Answer Questions

1. Explain the complete learning, forwarding, filtering and flooding process of an Ethernet switch.
2. Describe how VLANs, 802.1Q trunks and inter-VLAN routing can be combined in a campus design.
3. Explain the operation and purpose of STP, RSTP and edge-port protection.
4. Compare Wi-Fi 4, Wi-Fi 5, Wi-Fi 6, Wi-Fi 6E and Wi-Fi 7 in terms of capability and deployment considerations.
5. Discuss the design principles of a secure enterprise wireless network.

Analytical / Application Questions

1. A switch has redundant links to two other switches, but broadcast traffic increases continuously after a new link is installed. Analyse the likely cause and propose a verification and remediation plan.
2. A lecture hall has excellent signal strength but poor application throughput during class changes. Explain why this can occur and design a measurement-based improvement strategy.
3. Design a VLAN, IP-subnet, routing and wireless-security plan for an organisation with staff, students, voice devices, servers and guests. Justify your segmentation and policy decisions.

Multiple Choice Questions with Answers

Question 1

Which address does an Ethernet switch normally learn from an arriving frame?

A. The destination IP address

B. The source MAC address

C. The destination MAC address

D. The source TCP port

Correct Answer: B. The source MAC address

Question 2

What is the primary purpose of an 802.1Q trunk?

A. To encrypt all Ethernet frames

B. To carry multiple VLANs over one link

C. To assign IP addresses automatically

D. To prevent all broadcast traffic

Correct Answer: B. To carry multiple VLANs over one link

Question 3

What problem does Spanning Tree Protocol primarily prevent?

A. IP address exhaustion

B. Wireless authentication failure

C. Layer 2 forwarding loops

D. Incorrect DNS resolution

Correct Answer: C. Layer 2 forwarding loops

Question 4

Which device function is required for communication between different VLANs?

A. Layer 3 routing

B. MAC flooding

C. SSID broadcasting

D. Frame padding

Correct Answer: A. Layer 3 routing

Question 5

Which Wi-Fi generation introduced OFDMA as a major efficiency feature?

A. Wi-Fi 4

B. Wi-Fi 5

C. Wi-Fi 6

D. Wi-Fi 3

Correct Answer: C. Wi-Fi 6

Question 6

A wireless signal is measured at −55 dBm and the noise level at −ให้? dBm is invalid

A. The values cannot be subtracted because dBm is logarithmic

B. SNR is found by subtracting noise power in dBm from signal power in dBm

C. SNR is found by adding the two dBm values

D. SNR is always equal to the signal dBm value

Correct Answer: B. SNR is found by subtracting noise power in dBm from signal power in dBm

Question 7

Which security approach is most appropriate for individual user identities in an enterprise WLAN?

A. Open authentication

B. A single shared password for all users

C. WPA3-Enterprise with 802.1X

D. SSID hiding alone

Correct Answer: C. WPA3-Enterprise with 802.1X

Question 8

What is a major disadvantage of using very wide Wi-Fi channels in a dense deployment?

A. They eliminate the need for authentication

B. They consume more spectrum and may reduce channel reuse

C. They prevent all roaming

D. They convert wireless traffic into Ethernet broadcasts

Correct Answer: B. They consume more spectrum and may reduce channel reuse

Question 9

What does an access point primarily provide in a WLAN?

A. A radio connection between wireless clients and the wired network

B. A replacement for every Layer 3 router

C. A mechanism that removes all interference

D. A guaranteed application throughput rate

Correct Answer: A. A radio connection between wireless clients and the wired network

Question 10

Why should a trunk’s permitted VLAN list be restricted?

A. To increase the number of broadcast domains automatically

B. To reduce unnecessary exposure and configuration errors

C. To disable MAC learning

D. To force all traffic into the native VLAN

Correct Answer: B. To reduce unnecessary exposure and configuration errors