Upon completion of this tutorial, you should be able to:
The link layer is the second layer in the Internet protocol stack, situated directly above the physical layer and below the network layer. While the network layer provides end-to-end communication between hosts across potentially multiple networks, the link layer is responsible for node-to-node data transfer across a single communication link.
This tutorial establishes the foundational concepts of the link layer, providing the necessary context for all subsequent tutorials in this unit. We explore the link layer's role in the overall architecture, its core services, and the practical considerations of its implementation. A thorough understanding of these fundamentals is essential for network design, troubleshooting, and performance optimization in enterprise and data-center environments.
We also discuss the evolution of link-layer technologies from shared-media (e.g., Ethernet bus) to switched point-to-point links, and the impact of these changes on protocol design. The tutorial concludes with an introduction to modern trends such as link aggregation and virtualization.
The link layer sits between the physical layer and the network layer. Its primary responsibility is to transfer a datagram from one node to an adjacent node over a single link. Unlike the network layer, which is concerned with routing across multiple hops, the link layer is hop-by-hop. It does not know about the ultimate destination of the datagram; it only knows the next-hop node.
Example: A datagram sent from Host A to Host B traverses three links: A→R1, R1→R2, R2→B. The link layer on Host A creates a frame destined for R1's MAC address. When R1 receives the frame, it extracts the datagram, determines the next hop (R2), and creates a new frame destined for R2. Thus, each link has its own independent frame.
In many implementations, the link layer and physical layer are tightly integrated within a Network Interface Card (NIC) or chip.
In the OSI model, the link layer is split into two sublayers:
In the TCP/IP model, these are combined into a single link layer, but the distinction is still relevant in practice (e.g., IEEE 802 standards).
Framing encapsulates a network-layer datagram by adding a header and trailer. The header contains control information (e.g., source and destination MAC addresses, type/length). The trailer often contains an error-detection code.
Link access is the mechanism by which a node gains the right to transmit on the link. This is particularly important for shared media such as wireless or bus-based Ethernet. Protocols like CSMA/CD and CSMA/CA manage access. In point-to-point links, access is trivial (the node simply transmits when it has data).
The link layer may provide reliable data transfer between adjacent nodes, using acknowledgments and retransmissions. This is often implemented in wireless protocols (e.g., 802.11) but is typically absent in wired Ethernet where error rates are low.
Why link-layer reliability? It can improve efficiency by catching errors early and avoiding propagation of corrupt frames. However, it adds overhead and latency. The transport layer (e.g., TCP) provides end-to-end reliability, which is sufficient in many cases.
Flow control prevents a fast sender from overwhelming a slow receiver. At the link layer, it operates on a hop-by-hop basis. Techniques include stop-and-wait, sliding window, and credit-based schemes. These are similar in principle to transport-layer flow control but operate over a single link.
Error detection is ubiquitous; error correction is less common. The link layer typically uses CRC (Cyclic Redundancy Check) for error detection, which is highly effective. Some protocols (e.g., some wireless) use forward error correction (FEC) to correct errors without retransmission.
Used in older protocols like PPP (Point-to-Point Protocol). A special flag byte (e.g., 0x7E) marks the start and end of a frame. If the flag byte appears in the payload, it must be escaped (e.g., using byte stuffing).
Used in protocols like HDLC. A special bit pattern (e.g., 01111110) serves as the flag. The sender inserts a 0 after every five consecutive 1s in the payload (bit stuffing) to avoid the flag pattern. The receiver removes the stuffed bits.
Used in SONET/SDH. Frames are of fixed length, and synchronization is maintained by the physical layer's clock. No need for start/stop flags.
A typical frame includes:
MAC addresses are 48 bits (6 bytes), typically represented in hexadecimal (e.g., 00:1A:2B:3C:4D:5E). The first 3 bytes are the Organizationally Unique Identifier (OUI) assigned by the IEEE to a manufacturer; the last 3 bytes are assigned by the manufacturer.
| Aspect | MAC Address | IP Address |
|---|---|---|
| Layer | Link layer | Network layer |
| Length | 48 bits | 32 (IPv4) or 128 (IPv6) |
| Scope | Single link (LAN) | Global (Internet) |
| Assignment | Burned into hardware (OUI + manufacturer) | Assigned by network administrator or DHCP |
| Hierarchy | Flat | Hierarchical (network prefix + host) |
The sender transmits one frame and waits for an acknowledgment (ACK) before sending the next. Simple but inefficient for high-bandwidth, high-latency links (the bandwidth-delay product problem).
The sender can transmit up to N frames before receiving an acknowledgment. This allows for pipelining. A window of sequence numbers identifies frames that are in transit. Protocols like HDLC and PPP use variants of sliding window.
Used in Fibre Channel and InfiniBand. The receiver grants credits (amount of buffer space) to the sender. The sender can only transmit up to the number of credits.
ARQ protocols combine error detection and retransmission. Common types:
These are analogous to TCP's reliability mechanisms but operate on a single link, often with smaller windows and faster retransmission.
It is beneficial on links with high error rates (wireless) or high latency (satellite) where retransmission at the transport layer would be too costly. However, it adds complexity and overhead, so it is often avoided on low-error wired links.
A NIC is a hardware device that connects a host to a network medium. It implements both the physical layer and part of the link layer. Functions include:
The driver is software that interfaces the NIC with the operating system's network stack. It configures the NIC, manages buffers, and handles interrupts. Firmware runs on the NIC's embedded processor to handle low-level tasks like wake-on-LAN, offloading, and protocol processing.
Modern NICs offload certain functions from the CPU, such as checksum calculation, segmentation (TCP offload), and even full protocol processing (RDMA). This improves performance and reduces CPU overhead.
The IEEE 802 group defines standards for LAN and MAN technologies. Key subcommittees:
The LLC sublayer (802.2) provides a common interface to higher layers, while the MAC sublayer is specific to the physical medium.
Efficiency of a link-layer protocol depends on the ratio of data payload to total frame size, retransmission overhead, and delay. For a stop-and-wait ARQ, utilization U is given by:
U = (transmission time of frame) / (transmission time + round-trip time + processing time)
For sliding window, U can approach 1 if the window size is large enough to keep the pipe full.
Framing overhead = (header + trailer) / (total frame size). For Ethernet, overhead ≈ 18/1518 ≈ 1.2%. However, this is small; larger overhead occurs in protocols with longer headers or smaller payloads.
For a link with bandwidth B (bps) and delay D (seconds), the bandwidth-delay product is B×D bits. This represents the amount of data in transit. To achieve full utilization, the sender must have a window large enough to fill the pipe. This is a critical consideration in high-speed links.
Link aggregation combines multiple physical links into a single logical link, increasing bandwidth and providing redundancy. It operates at the link layer, with the aggregation group appearing as a single MAC address.
Virtual LANs (VLANs) allow a single physical LAN to be partitioned into multiple logical LANs. Frames are tagged with a VLAN identifier (IEEE 802.1Q). This is a form of link-layer virtualization.
SDN separates the control plane from the data plane. At the link layer, switches can be programmed via OpenFlow to forward frames based on more than just MAC addresses, enabling sophisticated traffic engineering.
Question 1: Which of the following is the primary responsibility of the link layer?
(b) Node-to-node data transfer across a single communication link
The link layer is responsible for transferring a datagram from one node to a physically adjacent node over a single link.
Question 2: What is a frame?
(b) A link-layer packet that encapsulates a datagram
A frame is the link-layer packet that encapsulates a network-layer datagram, adding a header and trailer.
Question 3: Where is link-layer functionality typically implemented in a host?
(b) In the network interface card (NIC) or on-chip
The link layer is implemented in the network adapter (NIC) or on a chip, which includes both link-layer and physical-layer functionality.
Question 4: Which of the following is NOT a service typically provided by the link layer?
(b) Routing
Routing is a network-layer function. The link layer provides framing, error detection, flow control, and link access.
Question 5: What is the difference between half-duplex and full-duplex communication?
(b) Half-duplex allows transmission in both directions but not simultaneously; full-duplex allows simultaneous transmission
With half-duplex, nodes at both ends of a link can transmit, but not at the same time. With full-duplex, they can transmit simultaneously.
Question 6: Why might a link-layer protocol provide reliable delivery on a wireless link but not on a fiber-optic link?
(b) Wireless links have higher error rates due to interference and signal attenuation
Wireless links experience higher error rates from interference, signal attenuation, and multipath effects. Reliable delivery is therefore more important on wireless links. Fiber-optic links have very low bit-error rates and may not need this service.
Question 7: What is the relationship between frames and datagrams?
(b) A frame encapsulates a datagram
The link layer encapsulates a network-layer datagram into a frame by adding a header and trailer.
Question 8: What are the three components of a link-layer frame?
(b) Header, payload, trailer
A frame consists of a header (containing addressing and control information), a payload (the encapsulated datagram), and a trailer (typically containing error-detection information).
Question 9: What is the purpose of flow control at the link layer?
(b) To pace transmission so the receiver is not overwhelmed
Flow control paces the transmission between adjacent sending and receiving nodes to prevent the receiver from being overwhelmed by data.
Question 10: What distinguishes MAC addresses from IP addresses?
(b) MAC addresses are used for node-to-node delivery on a single link; IP addresses are used for end-to-end delivery across networks
MAC addresses identify nodes on a specific link and are used in frame headers. IP addresses identify hosts globally and are used for network-layer routing.
Question 11: What is the significance of the OUI in a MAC address?
(b) It identifies the manufacturer of the NIC
The OUI (Organizationally Unique Identifier) is the first 24 bits of a MAC address and is assigned by the IEEE to a specific manufacturer.
Question 12: Which framing method uses byte stuffing to avoid the flag pattern in the payload?
(b) Byte-oriented framing
Byte-oriented framing (used in PPP) uses a flag byte and escapes any occurrence of that flag byte in the payload through byte stuffing.
Question 13: What is the LLC sublayer's primary role?
(b) Providing a uniform interface to the network layer
The LLC sublayer (802.2) provides a common interface to higher layers, handling flow control and error recovery, while the MAC sublayer handles access to the medium.
Question 14: In a sliding window flow control protocol with window size N, how many frames can the sender transmit before it must wait for an acknowledgment?
(c) N
The sender can transmit up to N frames before the window is exhausted and it must wait for an ACK to slide the window forward.
Question 15: Which of the following is a reason to implement reliable delivery at the link layer rather than relying solely on transport-layer reliability?
(c) To catch errors early and avoid forwarding corrupted frames
Link-layer reliability can prevent corrupted frames from being forwarded further, saving bandwidth and processing on subsequent links.
Question 16: What is the primary benefit of link aggregation (EtherChannel)?
(b) Increased bandwidth and redundancy
Link aggregation combines multiple physical links into a logical link, providing higher aggregate bandwidth and fault tolerance.
Question 17: What is the MAC broadcast address?
(b) FF:FF:FF:FF:FF:FF
The broadcast MAC address is all ones, used to send a frame to all nodes on the LAN.
Question 18: In Go-Back-N ARQ, if frame 2 is lost, what happens?
(b) Frames 2 through the end of the window are retransmitted
In Go-Back-N, when a timeout occurs for a frame, all frames from that frame onward (within the window) are retransmitted.
Question 19: What does the bandwidth-delay product represent?
(b) The amount of data that can be "in flight" on the link
The bandwidth-delay product (B×D) gives the number of bits that can be in transit at any moment. It is crucial for sizing the window in sliding window protocols to achieve full utilization.
Question 20: Which link-layer technology uses bit stuffing to avoid the flag pattern?
(b) HDLC
HDLC (High-Level Data Link Control) uses bit-oriented framing with a flag pattern of 01111110 and inserts a 0 after five consecutive 1s in the payload.
Exercise 1: Link-Layer Service Identification
For each of the following scenarios, identify which link-layer service is primarily involved:
Exercise 2: Link Layer vs. Network Layer
Consider a datagram traveling from Host A to Host B through three routers. How many link-layer frames are created and transmitted along this path? Explain your reasoning.
Four frames are created and transmitted:
Each link along the path requires a separate frame. The datagram is encapsulated in a frame at each hop, and each frame is specific to the link-layer technology used on that hop.
Exercise 3: NIC Functionality
A network interface card (NIC) is described as a combination of hardware, software (driver), and firmware. Give one example of a link-layer function performed by each component.
Exercise 4: Link-Layer Service Selection
A network administrator is designing a link-layer protocol for two different environments:
Which link-layer services would you recommend for each environment, and why?
Environment A (Fiber-optic backbone):
Environment B (Wireless, high interference):
Exercise 5: Frame Encapsulation Path
Describe the complete encapsulation process for a web request from a web browser, starting from the application layer down to the link layer. Identify what is added at each layer.
The frame is then transmitted over the physical link.
Exercise 6: Framing Overhead Calculation
A link-layer protocol uses a header of 20 bytes and a trailer of 4 bytes. The payload (datagram) is 1,500 bytes. What is the framing overhead as a percentage of the total frame size?
Total frame size = 1500 + 20 + 4 = 1524 bytes.
Overhead = (20 + 4) / 1524 × 100% = 24 / 1524 × 100% ≈ 1.575%.
Overhead ≈ 1.58%.
Exercise 7: Stop-and-Wait Utilization
A link has a data rate of 10 Mbps and a round-trip time (RTT) of 20 ms. The frame size is 1,500 bytes (12,000 bits). What is the maximum utilization of the link using stop-and-wait flow control (ignoring processing times)?
Transmission time Tframe = 12,000 bits / 10,000,000 bps = 0.0012 s = 1.2 ms.
RTT = 20 ms.
Utilization U = Tframe / (Tframe + RTT) = 1.2 / (1.2 + 20) = 1.2 / 21.2 ≈ 0.0566 = 5.66%.
The link is utilized only 5.66% of the time; the rest is idle waiting for ACKs.
Exercise 8: MAC Address Identification
Given the MAC address 01:23:45:67:89:AB, determine:
Exercise 9: Sliding Window Size
A link has a bandwidth of 1 Gbps and an RTT of 10 ms. The frame size is 1,500 bytes. What minimum window size (in frames) is needed to keep the link fully utilized (ignoring overhead)?
Bandwidth-delay product = 1e9 bps × 0.01 s = 10,000,000 bits.
Frame size in bits = 1500 × 8 = 12,000 bits.
Number of frames = 10,000,000 / 12,000 ≈ 833.33.
Minimum window size = 834 frames (to fully utilize the link).
Exercise 10: Comparing Reliable Delivery Protocols
Compare the impact of a single frame loss on Go-Back-N and Selective Repeat ARQ. Assume a window size of 8 and the loss occurs at frame 4. Which protocol is more efficient in terms of retransmissions?
Go-Back-N: When frame 4 is lost, the sender will eventually time out and retransmit frames 4, 5, 6, 7, and 8 (the entire window from frame 4 onward). This is a total of 5 retransmissions.
Selective Repeat: Only frame 4 is retransmitted. The receiver may have already buffered frames 5–8, which are then delivered in order after frame 4 is received.
Selective Repeat is more efficient (1 retransmission vs. 5) but requires more complex buffering and sequencing at the receiver.
Homework 1: Research and compare the link-layer services provided by Ethernet and Wi-Fi (IEEE 802.11). Which services are provided by both? Which are provided by only one? Why do these differences exist?
Both Ethernet and Wi-Fi provide framing, addressing (MAC addresses), and error detection.
Differences:
These differences exist because wireless links have fundamentally different physical characteristics (higher error rates, hidden terminal problems, variable signal strength) than wired links.
Homework 2: A datagram is 1,500 bytes. The link-layer protocol adds a 14-byte header and a 4-byte trailer. Calculate the total frame size and the framing overhead as a percentage of the total frame size.
Frame size = Payload + Header + Trailer = 1,500 + 14 + 4 = 1,518 bytes
Framing overhead = (Header + Trailer) / Total frame size × 100%
= (14 + 4) / 1,518 × 100%
= 18 / 1,518 × 100%
≈ 1.19%
The framing overhead is approximately 1.19% of the total frame size.
Homework 3: Explain why the link layer is said to provide services "between adjacent nodes" while the network layer provides services "end-to-end." Use an example with three routers to illustrate the distinction.
The link layer operates on a single link at a time, moving frames from one node to the next adjacent node. The network layer operates end-to-end, moving datagrams from the source host to the destination host across multiple links and routers.
Example: Host A sends a datagram to Host B through Routers R1, R2, and R3.
The link layer is unaware of the ultimate destination; it only knows the next hop. The network layer maintains the end-to-end context.
Homework 4: Research the IEEE 802 standards family. Identify at least five IEEE 802 standards and briefly describe what each one covers. Which standards are most relevant to the link layer?
IEEE 802 Standards (selected):
| Standard | Description |
|---|---|
| 802.1 | LAN/MAN architecture, internetworking, and network management (includes 802.1Q for VLANs and 802.1D for STP) |
| 802.2 | Logical Link Control (LLC) — the upper sublayer of the data link layer |
| 802.3 | Ethernet — CSMA/CD access method and physical layer specifications |
| 802.5 | Token Ring — now largely obsolete |
| 802.11 | Wireless LAN (Wi-Fi) — MAC and physical layer specifications |
| 802.15 | Wireless Personal Area Networks (WPAN) — includes Bluetooth |
| 802.16 | Broadband Wireless Access (WiMAX) |
Most relevant to the link layer: 802.2 (LLC), 802.3 (Ethernet), 802.11 (Wi-Fi), and 802.1 standards (VLANs, STP).
Homework 5: Consider the statement: "The link layer is the only layer implemented in every device on the Internet." Is this statement accurate? Justify your answer.
The statement is largely accurate but requires nuance. Every device that connects to the Internet must implement the link layer to interface with the physical network medium. However:
The link layer is indeed the only layer that every Internet-connected device must implement to participate in network communication, though many devices implement additional layers as well.
Homework 6: Explain the concept of "bandwidth-delay product" and its impact on link-layer protocol design. Provide a numerical example.
The bandwidth-delay product (BDP) is the product of the link bandwidth (bits per second) and the round-trip time (seconds). It represents the number of bits that can be in transit at any given time.
BDP = B × RTT
Impact on protocol design: To achieve full link utilization, a sliding window protocol must have a window size (in bits) at least equal to the BDP. If the window is too small, the sender will idle, wasting bandwidth. This is particularly critical for high-speed, long-delay links (e.g., satellite links).
Example: A link with bandwidth 100 Mbps and RTT 50 ms has BDP = 100×10^6 × 0.05 = 5,000,000 bits = 625,000 bytes. To fully utilize the link, the window size must be at least 625,000 bytes.
Homework 7: Describe the two sublayers of the data link layer in the OSI model. What are their respective functions, and how do they interact?
The OSI data link layer is divided into two sublayers:
Interaction: The network layer passes a datagram to the LLC sublayer, which adds an LLC header (if needed) and passes it to the MAC sublayer. The MAC sublayer then adds its own header/trailer and transmits the frame. On reception, the MAC sublayer removes its header/trailer and passes the frame up to LLC, which then delivers the datagram to the network layer.
Homework 8: What is the purpose of the "preamble" in an Ethernet frame? Why is it not considered part of the link-layer header?
The preamble (7 bytes of alternating 1s and 0s) and the Start Frame Delimiter (SFD) are used for synchronization at the physical layer. They allow the receiver to lock onto the bit stream and determine the frame boundaries.
They are not considered part of the link-layer header because they are not processed by the link-layer logic; they are strictly for physical-layer synchronization. The link layer starts at the destination MAC address field.
Homework 9: In a selective repeat ARQ protocol, why is it necessary to have a window size less than or equal to half the sequence number space?
In selective repeat, the sender and receiver windows are both of size N. To avoid ambiguity between new frames and retransmissions, the sequence number space must be at least 2×N. If the window size were greater than half the sequence number space, a situation could arise where a receiver acknowledges a frame, the ACK is lost, and the sender retransmits the frame. The receiver, having advanced its window, might interpret the retransmission as a new frame with the same sequence number, causing duplicate delivery or confusion. Thus, the requirement is N ≤ (sequence number space)/2.
Homework 10: Research and describe the concept of "link-layer offloading" in modern NICs. What functions are typically offloaded, and what are the benefits?
Link-layer offloading refers to the delegation of certain network processing tasks from the host CPU to the NIC hardware. Common offloaded functions include:
Benefits: Reduced CPU utilization, lower latency, and higher throughput, especially in high-speed networks (10 Gbps and above). It allows the CPU to handle other tasks while the NIC processes network traffic.
This tutorial provided a comprehensive introduction to the link layer and its core services. We covered:
This foundation sets the stage for subsequent tutorials on error detection, multiple access protocols, addressing, and specific LAN technologies like Ethernet and Wi-Fi. Understanding these principles is critical for network analysis, design, and troubleshooting.