Data Link Layer Protocols
Ethernet, MAC addressing, ARP, switching, VLANs, 802.1X, and Layer 2 security fundamentals
Chapter 3: Data Link Layer Protocols
The Hospital That Lost Its Network
In 2016, a hospital’s entire network crashed during a critical surgery. The cause? An engineer had connected both ends of a patch cable to the same switch, creating a Layer 2 loop. Within seconds, broadcast storms overwhelmed every switch in the building. Monitoring systems went dark. Infusion pumps lost connectivity. For eight terrifying minutes, the surgical team worked blind while network engineers frantically traced cables.
The network had no Spanning Tree Protocol enabled—a basic Layer 2 safeguard. This incident, fortunately ending without patient harm, illustrates a crucial truth: Layer 2 might seem simple compared to routing and applications, but its failures can be catastrophic and immediate.
The Data Link layer sits at a critical junction in the network stack. It’s where raw bits become structured frames, where local addressing happens, and where many of the most devastating network attacks occur. ARP spoofing, MAC flooding, VLAN hopping—these attacks exploit fundamental assumptions about local network trust.
In this chapter, we’ll explore Ethernet, MAC addressing, ARP, switching, VLANs, and the security mechanisms that protect (or fail to protect) Layer 2 networks.
The Bridge Between Physical and Logical
The Physical layer deals in raw bits—electrical pulses, light flashes, or radio waves. The Network layer deals in global addresses and routing across the internet. Between them sits the Data Link layer, providing the crucial service of organizing bits into meaningful units and delivering them between devices on the same local network.
What the Data Link Layer Does
When your computer sends data to your router, that data doesn’t magically appear at the router. The Data Link layer:
- Packages data into frames with structured headers and trailers
- Addresses frames using MAC addresses (hardware addresses)
- Detects transmission errors using CRC checksums
- Coordinates access to the shared physical medium
Understanding this layer is essential for network security because many powerful attacks exploit how the Data Link layer operates on trust assumptions that were never designed for hostile environments.
Ethernet: The Foundation of Wired LANs
A Brief History
Ethernet was invented at Xerox PARC in the early 1970s by Robert Metcalfe and David Boggs. The name comes from “luminiferous ether”—the hypothetical medium once thought to carry light waves through space.
The original Ethernet used coaxial cable in a bus topology, with all devices sharing a single cable. When one device transmitted, all others could hear it. This created the fundamental challenge Ethernet needed to solve: what happens when two devices try to transmit simultaneously?
Ethernet Evolution
Ethernet has evolved dramatically since then:
| Generation | Speed | Media | Year | Notes |
|---|---|---|---|---|
| Original | 10 Mbps | Coax (10BASE5) | 1973 | Thick Ethernet |
| 10BASE-T | 10 Mbps | Twisted pair | 1990 | Star topology begins |
| Fast Ethernet | 100 Mbps | Cat5 | 1995 | 100BASE-TX |
| Gigabit | 1 Gbps | Cat5e/Fiber | 1999 | 1000BASE-T |
| 10 Gigabit | 10 Gbps | Cat6a/Fiber | 2002 | Data centers |
| 25/40/100 Gb | 25-100 Gbps | Fiber | 2010s | Cloud/HPC |
| 200/400 Gb | 200-400 Gbps | Fiber | 2020s | Hyperscale |
Throughout this evolution, the basic frame structure and addressing scheme have remained remarkably consistent.
The Ethernet Frame
Ethernet organizes data into units called frames. A frame is a structured sequence of bytes with a defined format that both sender and receiver understand.
Ethernet II Frame Format
Ethernet II Frame Format:
═══════════════════════════════════════════════════════════════════════
┌──────────┬──────────┬──────────┬──────────┬───────────────────┬──────┐
│ Preamble │ Dest │ Source │EtherType │ Payload │ FCS │
│ 7 bytes │ MAC │ MAC │ 2 bytes │ 46-1500 bytes │4 byte│
│ + SFD │ 6 bytes │ 6 bytes │ │ │ │
│ 1 byte │ │ │ │ │ │
└──────────┴──────────┴──────────┴──────────┴───────────────────┴──────┘
│ │ │ │ │ │
│ │ │ │ │ │
│ │ │ │ │ │
▼ ▼ ▼ ▼ ▼ ▼
Synchronize Where to Who sent What's The actual Error
receiver's send this this inside? data check
clock frame frame (IPv4/ARP/ (CRC)
IPv6/VLAN)Preamble and Start Frame Delimiter (SFD) - 8 bytes: The preamble is a series of alternating 1s and 0s (10101010…) that allows the receiving NIC to synchronize its clock with the incoming signal. The final byte, the SFD (10101011), signals that the actual frame is about to begin. These bytes are typically stripped by the hardware before the frame reaches higher layers.
Destination MAC Address - 6 bytes: The hardware address of the intended recipient. This can be a unicast address (specific device), broadcast address (all devices on the segment), or multicast address (group of devices).
Source MAC Address - 6 bytes: The hardware address of the sending device. This is always a unicast address.
EtherType - 2 bytes: Indicates which protocol is encapsulated in the payload. Common values:
| EtherType | Protocol | Description |
|---|---|---|
| 0x0800 | IPv4 | Internet Protocol v4 |
| 0x0806 | ARP | Address Resolution Protocol |
| 0x86DD | IPv6 | Internet Protocol v6 |
| 0x8100 | 802.1Q | VLAN-tagged frame |
| 0x88A8 | 802.1ad | Q-in-Q (double VLAN tag) |
| 0x8847 | MPLS | Multiprotocol Label Switching |
Payload - 46 to 1500 bytes: The actual data being carried, typically an IP packet. The minimum payload size of 46 bytes ensures frames are long enough to detect collisions in original Ethernet designs. If the data is smaller, padding is added. The maximum of 1500 bytes is the standard Maximum Transmission Unit (MTU) for Ethernet.
Frame Check Sequence (FCS) - 4 bytes: A CRC-32 (Cyclic Redundancy Check) value calculated over the frame. The receiver recalculates the CRC and compares it to detect transmission errors. If they don’t match, the frame is silently discarded.
Security Note: Ethernet provides error detection but not error correction or authentication. Frames can be easily crafted with any source MAC address—the hardware doesn’t verify ownership. This fundamental lack of authentication enables MAC spoofing attacks.
** COMMON MISTAKE**
Confusing MTU with frame size. The MTU (1500 bytes) is the maximum payload size. The actual frame on the wire is larger due to headers (14 bytes) and trailer (4 bytes), plus preamble (8 bytes). For jumbo frames (MTU 9000), ensure all devices in the path support them—one non-jumbo device causes fragmentation or black-holing.
CSMA/CD: Handling Collisions
In shared Ethernet (hubs and the original bus topology), all devices compete for the same transmission medium. Ethernet uses CSMA/CD (Carrier Sense Multiple Access with Collision Detection) to manage this:
- Carrier Sense: Before transmitting, a device listens to check if the medium is in use
- Multiple Access: If the medium is quiet, the device transmits. Multiple devices can attempt access
- Collision Detection: While transmitting, the device monitors for collisions (another device transmitting simultaneously)
- Collision Handling: If a collision is detected, both devices stop, wait a random time (binary exponential backoff), and try again
CSMA/CD Process
CSMA/CD Process:
═══════════════════════════════════════════════════════════════════
Device A Shared Medium Device B
════════ ═════════════ ════════
│ │
│ 1. Listen - is anyone transmitting? │
│ (Carrier Sense) │
│ │
├──────────────────────────────────────────────────►│
│ TRANSMIT │
│◄──────────────────────────────────────────────────┤
│ │
│ 2. Collision detected! │
│ Both stop transmitting │
│ │
│ 3. Wait random backoff (0-2^n slots) │
│ Device A: 3 slot times │
│ Device B: 1 slot time │
│ │
│ Device B retries │
│◄──────────────────────────────────────────────────┤
│ SUCCESS │
│ │
│ Then Device A retries │
├──────────────────────────────────────────────────►│
│ SUCCESS │With modern switched Ethernet, each port has its own collision domain, and full-duplex connections eliminate collisions entirely. CSMA/CD is largely historical, but understanding it explains why Ethernet has minimum frame sizes and certain timing constraints.
MAC Addresses
Structure and Format
A MAC address (Media Access Control address) is a unique identifier assigned to network interfaces. Every Ethernet NIC in the world has a unique 48-bit (6-byte) MAC address burned into it during manufacture.
MAC addresses are typically written in hexadecimal, with bytes separated by colons or hyphens:
MAC Address Formats
MAC Address Formats:
═══════════════════════════════════════════════════════════════════
00:1A:2B:3C:4D:5E (Colon notation - Linux/macOS)
00-1A-2B-3C-4D-5E (Hyphen notation - Windows)
001A.2B3C.4D5E (Cisco notation)
MAC Address Structure (48 bits):
┌─────────────────────────┬─────────────────────────┐
│ OUI │ Device Identifier │
│ (First 24 bits/3 bytes)│ (Last 24 bits/3 bytes) │
│ │ │
│ Assigned by IEEE │ Assigned by vendor │
│ to manufacturers │ (unique per device) │
└─────────────────────────┴─────────────────────────┘
Example: 00:1A:2B:3C:4D:5E
├──────┤ ├──────┤
OUI Device
(Vendor) ID
Special bits in first octet:
Bit 0 (I/G): 0 = Unicast, 1 = Multicast
Bit 1 (U/L): 0 = Universally administered (vendor), 1 = Locally administeredOUI (Organizationally Unique Identifier): The first 24 bits identify the manufacturer. IEEE assigns OUIs to vendors. You can look up a MAC address prefix to identify the manufacturer—useful for network reconnaissance.
Device Identifier: The last 24 bits are assigned by the manufacturer, ensuring uniqueness within their allocation.
Special MAC Addresses
Broadcast Address: FF:FF:FF:FF:FF:FF A frame sent to the broadcast address is received by all devices on the local network segment. ARP requests, for example, use broadcast to find the MAC address corresponding to an IP.
Multicast Addresses: MAC addresses with the least significant bit of the first byte set to 1 are multicast addresses. These deliver frames to a group of interested receivers rather than all devices.
Unicast vs Multicast (first byte)
Unicast vs Multicast (first byte):
═══════════════════════════════════════════════════════════════════
Unicast: 00000000 (even number: 0x00, 0x02, 0x04...)
^
└── LSB = 0 means unicast
Multicast: 00000001 (odd number: 0x01, 0x03, 0x05...)
^
└── LSB = 1 means multicast
Common multicast MACs:
01:00:5E:xx:xx:xx - IPv4 multicast
33:33:xx:xx:xx:xx - IPv6 multicast
01:80:C2:00:00:00 - Spanning Tree Protocol (STP)
01:00:0C:CC:CC:CC - Cisco Discovery Protocol (CDP)Locally Administered Addresses: The second least significant bit of the first byte indicates whether the address is globally unique (manufacturer-assigned) or locally administered (set by network administrator). Virtual machines often use locally administered addresses.
MAC Address Lookup
Knowing that MAC addresses contain manufacturer information enables network reconnaissance:
# Online OUI lookup (many tools available)
# Example output for 00:1A:2B:xx:xx:xx
Vendor: Ayecom Technology Co., Ltd.
# Common manufacturer OUIs (memorize these for quick identification):
Apple: 00:03:93, 00:0A:27, 00:0D:93, 3C:15:C2, F0:18:98
Intel: 00:02:B3, 00:03:47, 00:1B:21, 3C:A9:F4
Cisco: 00:00:0C, 00:01:42, 00:17:94, 00:1E:BD
Dell: 00:06:5B, 00:08:74, 00:14:22, 18:03:73
VMware: 00:0C:29, 00:50:56 (virtual machines!)
VirtualBox: 08:00:27TRY IT YOURSELF
Look up MAC addresses on your network:
# Find your MAC address ip link show # Linux ifconfig | grep ether # macOS getmac # Windows # See MAC addresses of other devices (from ARP cache) arp -a # Look up vendor online # https://macvendors.com/ or use wireshark's OUI database
Security Note: MAC addresses can be easily changed (spoofed) in software, despite being “burned in” to hardware. Most operating systems allow setting arbitrary MAC addresses. This enables MAC spoofing attacks and can defeat MAC-based access controls. Never rely solely on MAC addresses for security.
Address Resolution Protocol (ARP)
The Problem ARP Solves
Imagine you’re on your computer at IP address 192.168.1.100, and you want to communicate with your router at 192.168.1.1. You know the router’s IP address, but to actually send an Ethernet frame, you need its MAC address. IP addresses mean nothing at Layer 2—switches and NICs only understand MAC addresses.
ARP (Address Resolution Protocol) bridges this gap, translating IP addresses (Layer 3) to MAC addresses (Layer 2). It’s a simple yet critical protocol, and its lack of authentication makes it a prime target for attacks.
How ARP Works
ARP uses two message types: ARP Request and ARP Reply.
ARP Request (Broadcast): When a device needs to find the MAC address for an IP, it sends an ARP request to the broadcast MAC address (FF:FF:FF:FF:FF:FF). The request says, essentially: “Who has IP 192.168.1.1? Tell 192.168.1.100.”
ARP Reply (Unicast): The device with the requested IP responds directly to the requester with its MAC address: “192.168.1.1 is at 00:11:22:33:44:55.”
ARP Resolution Process
ARP Resolution Process:
═══════════════════════════════════════════════════════════════════
Device A (192.168.1.100) Router (192.168.1.1)
MAC: AA:AA:AA:AA:AA:AA MAC: 00:11:22:33:44:55
│ │
│ 1. ARP Request (Broadcast) │
│ "Who has 192.168.1.1?" │
│ Destination: FF:FF:FF:FF:FF:FF │
├───────────────────────────────────────────►│
│ │ │
│ ┌─────────────┴───────────────┐ │
│ │ All devices receive this │ │
│ │ (it's broadcast) │ │
│ │ │ │
│ │ Only the owner of │ │
│ │ 192.168.1.1 responds │ │
│ └─────────────────────────────┘ │
│ │
│ 2. ARP Reply (Unicast) │
│ "192.168.1.1 is at 00:11:22:33:44:55" │
│◄───────────────────────────────────────────┤
│ Destination: AA:AA:AA:AA:AA:AA │
│ │
│ 3. Device A updates ARP cache │
│ 192.168.1.1 → 00:11:22:33:44:55 │
│ │ARP Packet Structure
ARP Packet Format
ARP Packet Format:
═══════════════════════════════════════════════════════════════════
┌────────────────┬───────────────┬────────┬───────────┬──────────┐
│ Hardware Type │ Protocol Type │ HW Len │ Proto Len │ Opcode │
│ (2 bytes) │ (2 bytes) │(1 byte)│ (1 byte) │(2 bytes) │
│ 0x0001=Eth │ 0x0800=IPv4 │ 0x06 │ 0x04 │ 1=Req │
│ │ │ │ │ 2=Reply │
├────────────────┴───────────────┴────────┴───────────┴──────────┤
│ Sender MAC Address (6 bytes) │
├────────────────────────────────────────────────────────────────┤
│ Sender IP Address (4 bytes) │
├────────────────────────────────────────────────────────────────┤
│ Target MAC Address (6 bytes) │
│ (00:00:00:00:00:00 for requests) │
├────────────────────────────────────────────────────────────────┤
│ Target IP Address (4 bytes) │
└────────────────────────────────────────────────────────────────┘The ARP Cache
To avoid constant ARP requests, devices maintain an ARP cache—a table mapping IP addresses to MAC addresses. When a device receives an ARP reply (or sees ARP traffic), it updates its cache. Entries typically expire after 2-20 minutes, depending on the operating system.
# View ARP cache on Linux/macOS
arp -a
# or
ip neigh show
# Example output:
192.168.1.1 at 00:11:22:33:44:55 on en0 ifscope [ethernet]
192.168.1.50 at aa:bb:cc:dd:ee:ff on en0 ifscope [ethernet]
# View ARP cache on Windows
arp -a
# Clear ARP cache (requires admin/root)
# Linux:
sudo ip -s -s neigh flush all
# macOS:
sudo arp -a -d
# Windows (elevated):
netsh interface ip delete arpcacheARP Security Vulnerabilities
ARP was designed in an era when networks were small, trusted environments. It has no authentication—any device can claim to own any IP address. This fundamental weakness enables ARP spoofing (also called ARP poisoning), one of the most powerful Layer 2 attacks.
ARP Spoofing Attack
ARP Spoofing Attack:
═══════════════════════════════════════════════════════════════════
Normal Operation:
─────────────────
Victim ──────────► Gateway
192.168.1.100 192.168.1.1
Victim's ARP cache:
192.168.1.1 → 00:11:22:33:44:55 (legitimate gateway MAC)
During ARP Spoofing Attack:
───────────────────────────
Attacker sends fake ARP replies:
"192.168.1.1 is at AA:BB:CC:DD:EE:FF" (attacker's MAC)
Victim ─────X─────► Gateway
│
└───────────► Attacker
AA:BB:CC:DD:EE:FF
Victim's ARP cache (poisoned):
192.168.1.1 → AA:BB:CC:DD:EE:FF (attacker's MAC!)
Now all traffic intended for gateway goes to attacker!In ARP spoofing, an attacker sends fake ARP replies to associate their MAC address with another device’s IP (commonly the gateway). Victims update their ARP cache with the false information and start sending traffic to the attacker instead of the legitimate destination. This enables man-in-the-middle attacks.
Security Note: ARP spoofing is covered in detail in Part II, Chapter 2. Defenses include static ARP entries, Dynamic ARP Inspection (DAI) on switches, and monitoring for ARP anomalies.
THINK ABOUT IT
ARP has no authentication because it was designed for trusted academic networks. If you were designing a protocol today to solve the same problem, what security measures would you include?
Switches and Switching
From Hubs to Switches
As discussed in Chapter 1, hubs are simple devices that repeat all traffic to all ports—every device sees every frame. This creates congestion, security issues, and collision problems. Switches solved these problems by learning which devices are connected to which ports and forwarding traffic only where it needs to go.
How Switches Learn
Switches build a MAC address table (also called a CAM table—Content Addressable Memory) by observing the source MAC address of frames arriving on each port. When a switch receives a frame:
- Learning: Record the source MAC address and the port it arrived on
- Forwarding Decision:
- If the destination MAC is in the table → forward to that port only (unicast)
- If the destination MAC is not in the table → flood to all ports except source (unknown unicast)
- If the destination MAC is broadcast/multicast → flood appropriately
Switch Learning Process
Switch Learning Process:
═══════════════════════════════════════════════════════════════════
Initial State: Empty MAC table
┌─────────────────────────┐
│ MAC Address Table │
│──────────────┬──────────│
│ MAC │ Port │
│ (empty) │ │
└──────────────┴──────────┘
Step 1: Device A (MAC AA:AA) sends frame from Port 1
Switch learns: AA:AA is on Port 1
┌──────────────┬──────────┐
│ MAC │ Port │
│ AA:AA:AA:AA │ 1 │
└──────────────┴──────────┘
Step 2: Device B (MAC BB:BB) sends frame from Port 2
Switch learns: BB:BB is on Port 2
┌──────────────┬──────────┐
│ MAC │ Port │
│ AA:AA:AA:AA │ 1 │
│ BB:BB:BB:BB │ 2 │
└──────────────┴──────────┘
Step 3: A wants to send to B
Switch looks up BB:BB → Port 2
Forwards ONLY to Port 2 (not flooding!)
Port 1 Port 2 Port 3
│ │ │
[Device A] ───► [Device B] [Device C]
(doesn't see
this traffic)MAC Address Table Details
# View MAC address table on Cisco switch
show mac address-table
# Example output:
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 0011.2233.4455 DYNAMIC Gi0/1
1 aabb.ccdd.eeff DYNAMIC Gi0/2
10 0022.3344.5566 DYNAMIC Gi0/5
# Table aging: Entries expire after 300 seconds (default)
# This is important - if a device moves to a different port,
# the old entry must age out or be replacedCollision Domains and Broadcast Domains
Collision Domain: A network segment where collisions can occur if two devices transmit simultaneously. In hub-based networks, all ports share one collision domain. Switches create separate collision domains for each port—devices on different ports can transmit simultaneously without collision.
Broadcast Domain: A network segment where broadcast frames are received by all devices. A standard switch is one broadcast domain—broadcasts reach all ports. Routers (Layer 3 devices) separate broadcast domains.
Collision Domains and Broadcast Domains
Collision Domains and Broadcast Domains:
═══════════════════════════════════════════════════════════════════
Hub-Based Network: Switch-Based Network:
────────────────── ─────────────────────
┌──────────────┐ ┌──────────────┐
│ HUB │ │ SWITCH │
└┬───┬───┬───┬─┘ └┬───┬───┬───┬─┘
│ │ │ │ │ │ │ │
A B C D A B C D
1 Collision Domain 4 Collision Domains
1 Broadcast Domain 1 Broadcast Domain
All devices compete Each port has its own
for same bandwidth full bandwidth
Router Separates Broadcast Domains:
───────────────────────────────────
┌────────────┐ ┌────────────┐
│ Switch 1 │ │ Switch 2 │
└─────┬──────┘ └──────┬─────┘
│ ┌────────┐ │
└─────┤ ROUTER ├────────┘
└────────┘
Broadcast Domain 1 Broadcast Domain 2
(Broadcasts don't (Separate from BD1)
cross the router)Security Note: The MAC address table has finite size (typically 8K-128K entries depending on switch model). In a MAC flooding attack, an attacker sends frames with thousands of fake source MAC addresses, filling the table. When the table is full, the switch can’t learn new addresses and must flood all traffic—turning it into a hub and allowing the attacker to see all traffic. We cover this attack in Part II, Chapter 2.
VLANs (Virtual Local Area Networks)
The Problem VLANs Solve
Imagine a company with multiple departments—Engineering, Sales, HR—all on the same floor, connected to the same switches. Without any separation, a broadcast from an Engineering computer reaches everyone. More concerning, any compromised device can potentially access traffic from any department.
VLANs solve this by creating logical network segments within a physical switch infrastructure. Devices in different VLANs cannot communicate directly, even if they’re connected to the same switch—traffic between VLANs must go through a router (Layer 3 device).
How VLANs Work
Each switch port is assigned to a VLAN. Frames are tagged internally with their VLAN ID, and the switch only forwards frames within the same VLAN.
VLAN Example
VLAN Example:
═══════════════════════════════════════════════════════════════════
Same Physical Switch, Logically Separated:
┌──────────────────────────────────────────────────────────┐
│ SWITCH │
│ ┌───────────┐ ┌──────────┐ ┌──────────┐ │
│ │ VLAN 10 │ │ VLAN 20 │ │ VLAN 30 │ │
│ │Engineering│ │ Sales │ │ HR │ │
│ └────┬──────┘ └────┬─────┘ └────┬─────┘ │
│ │ │ │ │
└───────┼────────────────┼───────────────┼─────────────────┘
│ │ │
┌────┴────┐ ┌─────┴────┐ ┌────┴────┐
│ Eng │ │ Sales │ │ HR │
│Computers│ │Computers │ │Computers│
└─────────┘ └──────────┘ └─────────┘
Broadcasts in VLAN 10 don't reach VLAN 20 or 30
Traffic between VLANs must go through a router
VLAN 10 Router VLAN 20
│ │ │
└───────────────────────┴────────────────────────┘
Inter-VLAN routing
(Layer 3 required)802.1Q VLAN Tagging
When frames need to travel between switches, they must carry their VLAN information. IEEE 802.1Q defines how VLAN tags are inserted into Ethernet frames.
802.1Q Tagged Frame
802.1Q Tagged Frame:
═══════════════════════════════════════════════════════════════════
Standard Ethernet Frame:
┌─────────┬─────────┬──────────┬─────────────────────────┬─────────┐
│Dest MAC │Src MAC │EtherType │ Payload │ FCS │
│ 6 bytes │6 bytes │ 2 bytes │ │ 4 bytes │
└─────────┴─────────┴──────────┴─────────────────────────┴─────────┘
802.1Q Tagged Frame (4 bytes inserted):
┌─────────┬─────────┬─────────────────────┬──────────┬──────────────┬─────────┐
│Dest MAC │Src MAC │ 802.1Q Tag │EtherType │ Payload │ FCS │
│ 6 bytes │6 bytes │ (4 bytes) │ 2 bytes │ │ 4 bytes │
└─────────┴─────────┴─────────────────────┴──────────┴──────────────┴─────────┘
│
┌─────────┴─────────┐
│ │
┌───────┴───────┬───────────┴───────┐
│ TPID │ TCI │
│ (2 bytes) │ (2 bytes) │
│ 0x8100 │ │
└───────────────┴───────────────────┘
│
┌───────────────┼───────────────┐
│ │ │
┌────┴────┐ ┌────┴────┐ ┌────┴────┐
│Priority │ │ DEI │ │VLAN ID │
│ 3 bits │ │ 1 bit │ │ 12 bits │
│(0-7 QoS)│ │(discard)│ │(1-4094) │
└─────────┘ └─────────┘ └─────────┘
VLAN ID range: 1-4094 (0 and 4095 reserved)Access Ports vs Trunk Ports:
| Port Type | Connects | Frames | VLAN Handling |
|---|---|---|---|
| Access | End devices | Untagged | Switch adds/removes tags internally |
| Trunk | Switches | Tagged (802.1Q) | Tags preserved across link |
| Native VLAN | N/A | Untagged on trunk | Default VLAN for untagged frames |
Access vs Trunk Ports
Access vs Trunk Ports:
═══════════════════════════════════════════════════════════════════
Access Port Trunk Port
─────────── ──────────
[Computer] ──── [Switch 1] ════════════ [Switch 2]
│ │
Access Port Trunk Port
│
Computer sends │ Frames on trunk
untagged frames │ carry 802.1Q tags
│ (except native VLAN)
▼
Switch internally assigns
VLAN based on port configVLAN Security Considerations
While VLANs provide network segmentation, they’re not a perfect security boundary:
VLAN Hopping Attacks:
- Switch Spoofing: Attacker configures their NIC to act like a trunk port, potentially accessing multiple VLANs
- Double Tagging: Attacker sends frames with two 802.1Q tags; outer tag is stripped by first switch, inner tag routes to victim VLAN
Double Tagging Attack
Double Tagging Attack:
═══════════════════════════════════════════════════════════════════
Attacker is on VLAN 10 (native VLAN)
Target is on VLAN 20
Attacker sends double-tagged frame:
┌────────┬────────────┬────────────┬─────────────┐
│Eth Hdr │Outer Tag │Inner Tag │ Payload │
│ │VLAN 10 │VLAN 20 │ │
│ │(native) │(target) │ │
└────────┴────────────┴────────────┴─────────────┘
Switch 1 (receiving on native VLAN):
- Strips outer tag (it's native VLAN, untagged expected on trunk)
- Forwards with only inner tag (VLAN 20)
Switch 2:
- Receives frame tagged VLAN 20
- Delivers to VLAN 20!
Frame reached VLAN 20 from VLAN 10!
(Note: Only works one-way, no return path)VLAN Security Best Practices:
- Never use VLAN 1 for production traffic
- Change native VLAN to unused VLAN
- Explicitly configure access ports (don’t rely on DTP)
- Disable unused ports and put them in unused VLAN
- Use Private VLANs for additional isolation
- Prune unnecessary VLANs from trunks
Security Note: VLAN hopping attacks are covered in Part II, Chapter 2. Proper switch hardening can prevent most of these attacks.
802.1X: Network Access Control
The Problem 802.1X Solves
Traditional network access is simple: plug in a cable, get network access. But in enterprise environments, this is a security nightmare. Anyone who gains physical access can connect to the network.
802.1X provides port-based Network Access Control (NAC). Before a device can access the network, it must authenticate. Until then, only authentication traffic is allowed.
802.1X Components
802.1X Architecture
802.1X Architecture:
═══════════════════════════════════════════════════════════════════
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ Supplicant │ │ Authenticator│ │Authentication│
│ (Client) │ │ (Switch) │ │ Server │
│ │ │ │ │ (RADIUS) │
└──────┬───────┘ └──────┬───────┘ └──────┬───────┘
│ │ │
│ 1. EAPOL-Start │ │
├───────────────────►│ │
│ │ │
│ 2. EAP-Request │ │
│ Identity │ │
│◄───────────────────┤ │
│ │ │
│ 3. EAP-Response │ │
│ Identity │ │
├───────────────────►│ │
│ │ │
│ │ 4. RADIUS Access- │
│ │ Request │
│ ├───────────────────►│
│ │ │
│ │ 5. RADIUS Access- │
│ │ Challenge │
│ │◄───────────────────┤
│ │ │
│ 6. EAP-Request │ │
│ (Method) │ │
│◄───────────────────┤ │
│ │ │
│ 7. EAP-Response │ │
│ (Credentials) │ │
├───────────────────►│ │
│ │ │
│ │ 8. RADIUS Access- │
│ │ Request │
│ ├───────────────────►│
│ │ │
│ │ 9. RADIUS Accept │
│ │ (with VLAN) │
│ │◄───────────────────┤
│ │ │
│ 10. EAP-Success │ │
│◄───────────────────┤ │
│ │ │
│ PORT AUTHORIZED │ │
│ (Network Access) │ │
│◄══════════════════►│ │Supplicant: The client device requesting access (computer, phone, IoT device)
Authenticator: The network device controlling access (switch, wireless AP)
Authentication Server: Validates credentials (typically RADIUS server)
EAP Methods
EAP (Extensible Authentication Protocol) is a framework supporting multiple authentication methods:
| EAP Method | Description | Security Level |
|---|---|---|
| EAP-MD5 | Password hash | Low (no mutual auth) |
| EAP-TLS | Certificate-based | High (mutual auth, PKI required) |
| EAP-TTLS | TLS tunnel + inner method | High |
| PEAP | TLS tunnel + MSCHAPv2 | High (most common) |
| EAP-FAST | Cisco, uses PAC | High |
PEAP (Protected EAP) is most common in enterprises:
- Establishes TLS tunnel to RADIUS server
- User authenticates within tunnel (usually username/password)
- Server certificate validates server identity
802.1X Security Benefits
- Identity-based access: Know who/what is on your network
- Dynamic VLAN assignment: Users can be placed in appropriate VLAN based on identity
- Guest access control: Unauthenticated devices can be redirected to captive portal
- Endpoint compliance: Can check device health before granting access (NAC)
- Audit trail: Authentication events are logged
802.1X Bypass Techniques
Attackers have developed techniques to bypass 802.1X:
- MAC Authentication Bypass (MAB): If enabled for devices that can’t do 802.1X, attacker spoofs authorized MAC
- Hub insertion: Place hub between authenticated device and switch
- Transparent bridge: Bridge traffic through authenticated device
- VLAN manipulation: If dynamic VLAN assignment isn’t properly secured
Security Note: 802.1X bypass techniques are covered in Part II, Chapter 2. Defense requires proper configuration and additional controls like MACSec.
Spanning Tree Protocol (STP)
The Loop Problem
Network designers often want redundant paths for reliability—if one link fails, traffic can use another. However, creating physical loops in a switched network causes serious problems:
- Broadcast Storms: Broadcasts loop endlessly, multiplying and consuming all bandwidth
- MAC Table Instability: The switch sees the same MAC on multiple ports, constantly updating its table
- Multiple Frame Delivery: Unicast frames can be delivered multiple times
How STP Works
The Spanning Tree Protocol (IEEE 802.1D and later 802.1w for Rapid STP) prevents loops by logically disabling redundant paths while keeping them available for failover.
Spanning Tree Protocol
Spanning Tree Protocol:
═══════════════════════════════════════════════════════════════════
Physical Topology (has loops):
┌────────────┐ ┌────────────┐
│ Switch A │═══════════│ Switch B │
│(Root Bridge│ │ │
│ BID: 1000) │ │ BID: 2000 │
└─────┬──────┘ └─────┬──────┘
│ │
│ │
│ ┌────────────┐ │
└════│ Switch C │══════┘
│ BID: 3000 │
└────────────┘
STP Logical Topology (loop-free):
┌────────────┐ ┌────────────┐
│ Switch A │═══════════│ Switch B │
│ (ROOT) │ RP DP │ │
└─────┬──────┘ └─────┬──────┘
│ DP │ RP
│ │
│ ┌────────────┐ │
└════│ Switch C │══════X ← BLOCKED PORT
DP │ │ (prevents loop)
└────────────┘
RP = Root Port (best path to root)
DP = Designated Port (forwards traffic)
Blocked = Neither (breaks the loop)STP works by:
- Electing a Root Bridge: One switch becomes the “root” of the spanning tree (lowest Bridge ID wins)
- Calculating Paths: Each switch determines its best path to the root
- Blocking Redundant Ports: Ports that would create loops are put in “blocking” state
- Monitoring: If a link fails, blocked ports can transition to forwarding
STP Versions
| Version | Standard | Convergence | Notes |
|---|---|---|---|
| STP | 802.1D | 30-50 seconds | Original, slow |
| RSTP | 802.1w | 1-2 seconds | Rapid, most common |
| MSTP | 802.1s | 1-2 seconds | Multiple spanning trees per VLAN |
STP Security Implications
STP manipulates traffic flow, which attackers can exploit:
Root Bridge Manipulation: By advertising a lower Bridge ID, an attacker’s device can become the root bridge, forcing all traffic to flow through it.
STP Denial of Service: Sending topology change notifications can cause network instability as switches constantly recalculate.
Defenses:
- BPDU Guard: Disable port if BPDU received (use on access ports)
- Root Guard: Prevent port from becoming root port
- BPDU Filter: Stop sending/receiving BPDUs (use with caution)
Security Note: STP attacks are covered in Part II, Chapter 2.
Layer 2 Security Summary
Defense in Depth at Layer 2
| Threat | Attack | Defense |
|---|---|---|
| MAC Spoofing | Attacker changes MAC | Port Security, 802.1X |
| ARP Spoofing | Fake ARP replies | DAI, Static ARP, ARP inspection |
| MAC Flooding | Overflow CAM table | Port Security limits |
| VLAN Hopping | Double tagging, switch spoofing | Proper VLAN config, no native VLAN |
| STP Manipulation | Become root bridge | BPDU Guard, Root Guard |
| Unauthorized Access | Physical connection | 802.1X, NAC |
Switch Hardening Checklist
Basic Switch Hardening
Basic Switch Hardening:
═══════════════════════════════════════════════════════════════════
□ Change default passwords
□ Enable SSH, disable telnet
□ Configure management VLAN (not VLAN 1)
□ Disable unused ports
□ Put unused ports in "black hole" VLAN
□ Configure all ports as access (not auto/trunk)
□ Enable port security with MAC limits
□ Enable BPDU Guard on access ports
□ Enable Root Guard on non-root ports
□ Enable Dynamic ARP Inspection (DAI)
□ Enable DHCP Snooping
□ Configure native VLAN (not VLAN 1)
□ Enable logging to central syslog
□ Enable NTP for synchronized timestamps
□ Regular firmware updatesKey Takeaways
-
Ethernet frames data with addressing and error detection, forming the foundation of wired LANs
-
MAC addresses provide hardware-level device identification but can be easily spoofed
-
ARP translates IP addresses to MAC addresses, but lacks authentication—making it vulnerable to spoofing attacks
-
Switches intelligently forward traffic based on MAC addresses, creating efficient networks, but their CAM tables can be overwhelmed
-
VLANs provide logical segmentation but aren’t a complete security boundary—proper configuration is essential
-
802.1X provides identity-based network access control, significantly improving security
-
STP prevents loops but can be manipulated if not properly secured
Self-Assessment
-
Comprehension: Why can an attacker send ARP replies for IP addresses they don’t own?
-
Application: A switch suddenly starts flooding all unicast traffic to all ports. What attack might be occurring?
-
What if: If 802.1X is deployed but MAB (MAC Authentication Bypass) is enabled for IoT devices, what risk remains?
Review Questions
- What information does an Ethernet frame header contain?
- How does a switch learn which devices are connected to which ports?
- Why is ARP vulnerable to spoofing attacks?
- What’s the difference between a collision domain and a broadcast domain?
- How do VLANs improve network security, and what are their limitations?
- What is the purpose of 802.1X, and what are its three main components?
Key RFCs and Standards
- RFC 826 - An Ethernet Address Resolution Protocol (ARP)
- RFC 5227 - IPv4 Address Conflict Detection
- IEEE 802.3 - Ethernet
- IEEE 802.1Q - Virtual LANs
- IEEE 802.1X - Port-Based Network Access Control
- IEEE 802.1D/w/s - Spanning Tree Protocol variants