The Data Link Layer
Framing, error detection, and medium access — what the link layer adds on top of raw signal.
Summary#
The data link layer (Layer 2 in the OSI model) sits directly above the physical layer and turns a raw stream of bits on a wire, fibre, or radio link into something a network-layer protocol like IP can use. It does three jobs: it carves the bit stream into discrete units called frames, it detects (and sometimes corrects) transmission errors, and on shared media it decides which station gets to transmit when.
Layer 2 is the boundary where “signal” becomes “packet”. Above it, IP can pretend every link delivers framed, mostly-error-free packets to a directly attached neighbour. Below it, the physical layer can pretend it only has to clock bits, not understand them. The link layer also defines the addressing scheme used inside one link — MAC addresses for Ethernet and Wi-Fi — which is locally unique but not routable beyond the broadcast domain.
Why it matters#
Every IP packet is wrapped in a Layer 2 frame before it touches the wire, and the frame is what actually gets delivered hop by hop. When an interface is up but no traffic flows, the failure is almost always at Layer 1 or Layer 2 — bad cable, wrong VLAN, duplex mismatch, ARP cache stale, Wi-Fi association lost. Engineers who can tell “is my link healthy?” from “is my routing healthy?” debug twice as fast.
The link layer is also where the deepest performance levers live. A 1500-byte Ethernet MTU forces TCP to fragment large payloads into many segments; jumbo frames at 9000 bytes change throughput by 5x on a clean LAN. A Wi-Fi link with retries hidden at Layer 2 looks fine to ping but tanks TCP throughput when retransmissions stack on top of congestion control. None of this is visible above the link layer, but all of it determines what the upper layers feel.
How it works#
The link layer does three jobs in sequence: framing, error detection, and medium access. Some links also add flow control and a sub-layer for logical addressing.
Framing#
The link layer needs to know where each frame starts and ends in a continuous bit stream. Three common techniques:
- Length-prefixed. The frame header carries a length field; the receiver reads that many bytes.
- Delimiter sequences. A special bit pattern (Ethernet’s preamble + SFD, HDLC’s
01111110flag) marks frame boundaries. Bit-stuffing or byte-stuffing escapes the pattern when it appears in the payload. - Inter-frame gap. On Ethernet, a minimum idle period between frames lets receivers re-sync.
A typical Ethernet II frame on the wire looks like this:
+----------+-----+-------+-------+----------+----------+-----+| Preamble | SFD | Dst | Src | EtherType| Payload | FCS || 7 B | 1 B | 6 B | 6 B | 2 B | 46-1500B | 4 B |+----------+-----+-------+-------+----------+----------+-----+Error detection#
Frames carry a checksum (Ethernet’s FCS is a 32-bit CRC) computed over the frame contents. The receiver recomputes the CRC and discards the frame on mismatch. CRCs catch all single-bit errors, all errors of odd weight, and almost all burst errors up to the CRC width. They are not cryptographic — they detect accidents, not attacks.
Some link layers (Wi-Fi, some cellular) layer forward-error-correction on top of CRCs so they can repair small errors instead of dropping the frame. Wired Ethernet does not — it relies on retransmission at higher layers.
Medium access control (MAC)#
On a shared medium (classic Ethernet hubs, Wi-Fi, satellite uplinks) more than one station may want to transmit at once. The MAC sub-layer arbitrates. Three families:
- Channel partitioning — TDMA, FDMA, CDMA. Carve the medium into slots and assign them.
- Random access — ALOHA, CSMA, CSMA/CD, CSMA/CA. Stations listen, try, and back off on collision.
- Taking turns — token passing (Token Ring, FDDI), polling. A central or rotating authority grants permission.
Modern switched Ethernet has almost no contention — every host has its own collision-free link to a switch — so MAC is mostly a Wi-Fi concern today.
Variants and trade-offs#
Other axes:
- MTU. 1500 bytes on Ethernet; 9000 with jumbo frames; 1492 over PPPoE; ~2304 on Wi-Fi. Mismatches cause Path MTU Discovery to kick in (and silently fail when ICMP is blocked).
- Reliability. Some link layers (Wi-Fi, LTE) retransmit lost frames at Layer 2 so upper layers see fewer losses. Wired Ethernet does not — TCP handles loss. Hidden Layer-2 retries can confuse TCP’s loss-based congestion control.
- Addressing. MAC addresses (48-bit, globally unique by manufacturer assignment) name interfaces on a link. They do not route — a packet leaving the local broadcast domain gets a new Layer 2 header at every hop.
- Bridging vs routing. Switches forward frames inside a broadcast domain (Layer 2). Routers forward packets between domains (Layer 3). The line is sharp at the protocol level; less so in products marketed as “Layer 3 switches”.
Why does the link layer have its own addressing if IP already exists?
Two reasons. First, the link layer predates IP and has to work for non-IP protocols too (IPX, AppleTalk, raw Ethernet in industrial control). Second, an IP address is bound to a host’s network location; a MAC address is bound to the hardware. ARP maps from the routable-but-mobile IP to the locally-unique-but-fixed MAC, so a host can change subnets without changing identity and a NIC keeps its MAC across operating systems.
When this is asked in interviews#
Layer 2 questions cluster in three places: warm-up screening, troubleshooting scenarios, and datacenter-network design. Expect “what’s the difference between a switch and a router?”, “what does an Ethernet frame look like?”, “why doesn’t IP have a length field for the link payload?” early. Stronger candidates can sketch the frame layout from memory and explain why FCS is at the end (so it covers the whole frame and can be computed in hardware as bytes stream out).
Mid-loop questions probe scenarios: “you can ping by IP but not by hostname” (Layer 7 — DNS); “you can ping the gateway but nothing beyond” (Layer 3 routing); “you can’t even ping the gateway and arp -n shows incomplete” (Layer 2). The OSI vocabulary turns vague debugging into a sharp narrowing question.
Senior loops sometimes ask about VLANs, link aggregation (LACP), spanning tree convergence, or jumbo frames on a clos fabric. These are real concerns in any datacenter network and a good signal that the candidate has operated infrastructure.
Related concepts#