The only layer that touches a wire
Layer 2 has one job and it is narrow: move a chunk of data from one interface to another interface on the same link. It never crosses a router. Every packet you send starts and ends its life inside a layer 2 frame, and a fresh frame is built at every hop along the way.
The dominant layer 2 technology on wires is Ethernet, standardized as IEEE 802.3, and Wi-Fi (802.11) is a close cousin that reuses the same addressing. If you understand the Ethernet frame you understand layer 2.
A frame is the layer 2 PDU. Here are its fields in the order they go on the wire.
| Field | Size | What it holds |
|---|---|---|
| Preamble and SFD | 8 B | a clock sync pattern, not counted in frame size |
| Destination MAC | 6 B | which interface should pick this up |
| Source MAC | 6 B | which interface sent it |
| EtherType | 2 B | what protocol the payload is, 0x0800 for IPv4 |
| Payload | 46 to 1500 B | the IP packet |
| FCS | 4 B | a CRC-32 checksum over the whole frame |
Header plus trailer is 18 bytes, so a maximum frame is 1518 bytes carrying a 1500 byte payload. That 1500 is the MTU, and it is the number that shows up in half the strange networking bugs you will ever debug.
Two size rules matter. The payload has a minimum of 46 bytes, so a tiny packet gets padded to reach a 64 byte frame. And the FCS is a check, not a fix. A frame that fails its CRC is dropped silently. Nothing at layer 2 retransmits it, which is a promise TCP has to make instead.
MAC addresses
A MAC address (media access control) is a 48 bit identifier for one interface, written as six hex bytes separated by colons.
3c:22:fb:8a:19:04 |________| |______| OUI device vendor id serial
- The first 3 bytes are the OUI (organizationally unique identifier),
assigned to the manufacturer. 3c:22:fb is Apple, 00:50:56 is VMware.
- The last 3 bytes are chosen by that manufacturer so the whole address is
globally unique.
- Bit 0 of the first byte marks unicast (0) or multicast (1). Bit 1 marks
globally unique (0) or locally administered (1), which is what a laptop
sets when it randomizes its MAC for privacy on public Wi-Fi.
Three destination kinds exist, and switches treat them differently.
| Kind | Destination MAC | Who receives it |
|---|---|---|
| Unicast | one specific address | exactly one interface |
| Broadcast | ff:ff:ff:ff:ff:ff | every interface on the link |
| Multicast | starts with an odd first byte | interfaces that opted in |
MAC addresses are flat. There is no structure to sort or summarize, no "everything starting with 3c lives over there", because a vendor's cards are scattered all over the world. That is precisely why layer 2 cannot scale to the internet, and why layer 3 invented hierarchical addresses in the next unit.
Look at yours:
ip -brief link show
lo UNKNOWN 00:00:00:00:00:00 eth0 UP 3c:22:fb:8a:19:04 wlan0 DOWN a4:83:e7:11:6d:2c
Who talks when
One link is a shared medium, so something must decide who transmits. On old Ethernet, every host shared one coaxial cable, and two hosts transmitting at once produced a collision that garbled both frames. The rule was CSMA/CD (carrier sense multiple access with collision detection):
1. Listen. If the medium is busy, wait. 2. Transmit, and keep listening while you do. 3. If you hear a collision, stop, send a short jam signal, and wait a random time before retrying. Double the random range after each failure, which is called binary exponential backoff.
Modern switched Ethernet is full duplex, which means each host has its own dedicated pair to the switch, one direction each, so collisions cannot happen at all. CSMA/CD is effectively dead on wires. It survives conceptually on Wi-Fi as CSMA/CA, collision avoidance, because a radio cannot listen while it transmits, so it asks permission first instead of detecting damage afterwards.
That difference explains a lot of Wi-Fi behavior. Every station shares the air, so throughput is divided, and a distant station transmitting slowly holds the channel longer and slows everyone. On a switch, two conversations between different port pairs run at full speed at the same time.
Where the frame is built and rebuilt
The most common layer 2 misconception is that the source and destination MAC stay the same end to end. They do not. Only the IP addresses survive the trip.
Say your laptop 192.168.1.42 requests a page from 93.184.216.34. The frame
leaving your laptop looks like this:
dst MAC: aa:bb:cc:00:00:01 (your router, not the server) src MAC: 3c:22:fb:8a:19:04 (your laptop) dst IP : 93.184.216.34 (the server, unchanged) src IP : 192.168.1.42 (your laptop, unchanged)
The destination MAC is the router, because the server is not on this link and a MAC address cannot reach past it. The router strips that frame, keeps the IP packet, and builds a brand new frame with its own source MAC and the next hop's destination MAC. This repeats at every hop.
Rule to keep: layer 3 addresses say where the packet is ultimately going, layer 2 addresses say who hands it over next. Lesson 3-3 shows how a host learns that next hop's MAC in the first place.