Link Layer

The link layer carries network-layer packets across one local medium or virtual link. Ethernet and Wi-Fi use different framing details, but both provide local delivery beneath IP.

Ethernet Frames

An Ethernet frame contains destination and source MAC addresses, an EtherType or length field, payload, and a frame check sequence trailer. Physical transmission also uses a preamble and start delimiter. The frame check sequence detects corruption on the link; it does not repair a damaged frame or protect it cryptographically.

CheckWhat is the Ethernet frame check sequence used for?

Detecting frame corruption on the link. Encrypting the payload for all routed hops. Selecting an application by TCP port.

Switches and Local Delivery

An Ethernet switch learns which source MAC addresses appear on its ports and forwards known unicast frames toward the learned destination port. Broadcast and some unknown-destination traffic is flooded within the broadcast domain. VLANs can divide one switching system into separate logical link domains.

CheckWhat information does an Ethernet switch normally learn from frames?

Application passwords and HTTP cookies. Every router's complete Internet routing table. Source MAC addresses associated with switch ports.

Resolving the Next-Hop Address

For IPv4 on Ethernet, Address Resolution Protocol maps an on-link IPv4 next-hop address to a MAC address. The host first checks its neighbor cache. If needed, it broadcasts an ARP request, and the owner or an authorized proxy replies.

For an off-link IP destination, the host resolves the default or selected gateway's MAC address—not the remote destination's MAC. IPv6 uses Neighbor Discovery over ICMPv6 rather than ARP.

CheckWhich MAC address does a host use for an off-link IPv4 destination?

The selected next-hop router's MAC address. The remote server's MAC address across every router. A MAC address derived from the TCP destination port.

Inspecting Neighbor State

View IPv4 ARP and IPv6 Neighbor Discovery entries with:

$ ip neighbor show

States such as REACHABLE, STALE, DELAY, PROBE, and FAILED describe the neighbor-unreachability process. STALE does not mean broken; it means the cached reachability confirmation is no longer recent and can be tested on use.

CheckWhat does a STALE neighbor entry indicate?

The neighbor is permanently blocked by the firewall. The MAC address has been written to disk as a backup. The cached mapping lacks recent reachability confirmation.

Encapsulation Across a Router

The sender places an IP packet inside a frame addressed to its next hop. The router validates and removes the incoming frame, processes the IP header, selects an outgoing route, and builds a new frame for that link. The receiver reverses encapsulation and delivers the transport payload to the appropriate socket.

CheckWhat remains the same in ordinary forwarding while Ethernet framing changes at a router?

The IP destination, unless a middlebox such as NAT changes it. The incoming frame check sequence. The destination MAC address on every link.

Summary

You can now follow an IP packet through one local-link delivery step.

1. Identify the main Ethernet frame fields and integrity trailer.
2. Explain how a switch learns local forwarding locations.
3. Resolve an IPv4 next hop with ARP and IPv6 neighbors with NDP.
4. Interpret neighbor-cache state without overclaiming failure.
5. Recognize that routers rebuild frames for each outgoing link.