Showing results for 
Search instead for 
Did you mean: 

Overview of Layer 2 Switched Networks and Communication


General Overview of Layer 2

Layer 2 is Data Link Layer (DLL) as per OSI Model. As we know function of each layer is to provide services to above layer, so DLL provide various services to Layer 3: Network Layer. Various services which DLL provides are:

  • Framing network layer data packets.
  • Flow Control
  • Multiple Access control using CSMA/CD (Carrier Sense Multiple Access / Collision Detection) in wired network and CSMA / CA (Collision Avoidance) in wireless network.
  • Physical Addressing
  • Switching
  • Quality of Service (QoS)
  • Virtual LAN’s (VLAN)

             & some more.

Data Link Layer is basically divided into two sub-layers:

  • Logic Link Control (LLC): Provide services to upper layer.
  • Media Access Control (MAC): Perform Layer 2 functions like switching, physical addressing etc.

Basically what I am going to explain in this article is, how inter-communication happens in data network between two devices at Layer 2 (Switching).

Physical Addressing and Switching

Network is a group of devices connected to each other. On Layer 2, devices can communicate within a single network only. Layer 2 devices cannot span multiple networks, for multiple networks Layer 3 support is required.  Each device in a single network needs to be identified uniquely. At Layer 2, unique identification is done via physical addressing scheme. Device hardware (NIC Card) which provides interconnection has unique physical address assigned to it known as MAC Address. MAC address is of 48 bits, written in hexadecimal form separated after 8 bits with either colon (:) or hyphen (-). Example address: 00:80:48:5C:1A:52. So each machine will have unique physical address by which machine is identified. Total MAC Address is of 6 bytes. Each manufacturer is allotted with first 3 bytes of MAC Address which act as series prefix for all the NIC’s by that company, last 3 bytes are unique within one series. By this way no MAC address of one company can clash with another nor within company series.  Communication among devices at layer 2 is done via some interconnecting device, which forms connection between each host machine or network devices (router, wireless, etc). Switch is that device which provides interconnection. Switch has ports (physical interface) at which wires from various network devices or host machines connect. All devices in a network are connected to a switch which interconnects them; this is Layer 1 (inter-connection).  Now let’s get into deep understanding about how communication is done after interconnection. For this we need to understand working of switch.

Working of Switch

Switch is an interconnecting device with 16 or 24 ports in common. All other devices are connected to these ports. Whenever any machine sends packet to any other machine, source machine send packet to switch, switch then forwards it to destination machine. Each packet which comes to switch contains source and destination physical address in it, on basis of which switch forwards packet to other machine. Switch always sent packet based on destination MAC address. Its process is as follows: (process also known as Switching)

  • When switch receives a packet from any device, it checks for its destination MAC address.
  • Then switch compares destination MAC address with its MAC Address Table for corresponding MAC address.
      • If MAC Address is found, packet is sent out to port against which MAC Address was matched.
        • If entry is not found, Unknown  unicasts (when the switch  doesn't have a port mapping for a destination  mac address in the frame)  are treated like broadcasts by Layer Two  devices, and are flooded out  of all ports except the port on which the  frame originated.

    Now question comes, how does switch knows on which port destination machine is connected? For this switch uses one table in its cache memory called MAC Address table or Forwarding Table in which switch stores that at which port which machine is connected by storing its physical address (MAC Address). So table contains two columns (Physical Address and Port Number) and rows equal to number of ports in switch.  When switch is turned ON, by default there is no entry in MAC address table, as communication starts, based on devices involved entries are created in table. 

    Working of Address Resolution Protocol (ARP)

    ARP is a layer 2 protocol, used for obtaining MAC address of any devices within a network. Host machines use ARP protocol to obtain MAC Address. ARP protocol in conjunction with Layer 3 IP Protocol addressing (IP Address).  Host machine uses ARP because when machine needs to send packet to another device, destination MAC address is needed to be written in packet sent, so host machine should know the MAC Address of destination machine. Operating Systems also maintain ARP Table (MAC Address Table).  To obtain MAC address, ARP performs following process: (ARP request by host machine)
    • Source machine generate ARP REQUEST packet with source MAC address (of this machine), source IP address (of this machine) and destination IP address and forwards this packet to switch.
    • Switch receives the incoming packet and reads the source MAC address and checks its MAC address table, if entry for packet at incoming port is found then it checks its MAC address with the source MAC address and updates it, if entry not found then switch add and entry for incoming port with MAC address.
    • All ARP REQUEST packets are broadcasted in network, so switch broadcast ARP REQUEST packet in network.
    • (Broadcast are those packets which are sent to everyone in network except the sender, only in network to which it belongs, it cannot span multiple networks)
    • All devices in network receives ARP packet and compare their own IP address with the destination IP address in that packet.
    • Only the machine which matches the both will reply with ARP reply packet. This packet will have source IP of this machine (which was destination machine in previous packet, as now its replying this machine will be the source machine) , source MAC address, destination MAC address (same as source MAC address in REQUEST packet) and destination IP address (same as source IP address in REQUEST packet).
    • Then switch reads the ARP reply message and add entry in its MAC Address Table for port number on which it has received packet by reading its source MAC address field and forwards that packet to destination machine (source machine in REQUEST packet) as its MAC is in destination MAC address.
    • Further host machine add destination machine entry into its ARP table.
    This using ARP resolution switch and other devices in network obtain MAC address of any other device in a network. Remember ARP works on broadcast, so it works only in single network.

    Final Layer 2 Communication Process

    Now finally let’s see how devices communication occur at Layer 2.  Example Newtork Suppose Machine A needs to communicate with Machine D, following will be the process at Layer2:

    Summary Process

    • Machine A lookup’s for Machine D MAC address in its ARP table.

      • If MAC Address found then packet is formed and sent to Switch A.
      • If MAC address not found then ARP Request is generated and MAC address is obtained.

    • Switch A receives packet and checks for MAC Address in its MAC Address Table.

      • If MAC Address matched it will forward packet on matched port number.
      • If MAC Address not found then the packet is broadcasted to all ports, except on which it has received the packet.

    • Machine D receives packet from Switch A which was sent by Machine A.
    • When Machine D will reply, same process will be followed as switching is done.

    Detailed Process

    • Machine A lookup’s for Machine D MAC address in its ARP table. If MAC address is not found, machine A will send ARP Request for MAC address of machine D (using Machine D IP Address) and sends packet of Switch A.
    • Switch A will receive and read packet and add Machine A physical address in its MAC Address table to which Machine A is connected.
    • After that, switch will broadcast ARP Request packet in network.
    • All machines in network except Machine A will receive ARP Request packet. Then all machines will check for Destination IP address and compare with its own IP Address.
    • Only Machine D IP address matches with destination IP address as packet was intended for that machine.
    • Machine D will reply with its MAC Address (as per ARP working).
    • Switch A receives ARP Reply packet, and will add physical address of Machine D in its MAC Address table against corresponding port on which it received reply.
    • After adding entry it will check for destination MAC Address and compare it with its MAC address table.
    • Based on MAC Address table entry, it will forward packet to corresponding port number against which successful match was found.
    • Host machine will receive ARP Reply and add MAC address to its ARP table.
    • Then machines forms complete data packet and sends it to Switch A.
    • Switch A receives packet and updates it’s MAC Address Table and based on Destination MAC Address match with its MAC Address Tables, forwards packet on corresponding port.
    • In same manner other machine will reply and same process will repeat as point 12 and 13.
    Unknown  unicasts (when the switch  doesn't have a port mapping for a destination  mac address in the frame)  are treated like broadcasts by Layer Two  devices, and are flooded out  of all ports except the port on which the  frame originated

    Hi llakshitha,

    Firstly, every ARP request frame is flooded on each and every port, except on the port switch has received it. And every ARP reply is a unicast frame (one to one communication). So when every devices in network receive that frame, they check the ARP request header and check the IP address, if IP Address of ARP request matches their IP, they will reply back, else they will discard that ARP request. So in this case, the one machine for which the ARP request is generated will reply.

    Secondly, if a switch receive a frame and it doesn't know the destination MAC address (do not matter which frame it is), switch will flood that frame on every port like HUB except on port it has received it - these frames are called Unknown Unicast Frames. In this case, when all machine receive this frame which is not intended from them, they look at the destination MAC address, check with their own MAC, if it doesn't matches, machines will discard it.

    Kind Regards,


    Community Member

    Hi Sakun,

    As always, you have provided the detailed explanation.

    Thanks a lot.



    Community Member

    i have q question on binary values of the ip address.

    256   128   64   32   16    8      4       2   - hosts

      2       4     8    16    32   64   128   256 - sub nets 

    128    64   32   16    8      4       2      1 - binary value

      1       1     1     1     1      1       1      1 - bits

    2^7   2^6   2^5  2^4  2^3 2^2   2^1  2^0 =255

    we can write up to 255. we have 256 address including 0.basically hosts means number of addresses. in this table the binary value really means the number addresses? for ex 2^7=128 does it means we have 128 addresses? or does it means it is the value of that position. if it is the number of addresses how 2^0th position bit can have 2 host?

    when i see this table i feel it is the addresses because u all have 256 addresses. by dividing the number of addresses you get the number of sub nets. 256 sub nets means 256 addresses because in that position 2^0 position is 1 so it should have 1 address. how does it become 2 in the host row?

    if we calculate 2^0 has to have two host it should be 1 and the 2^1 position we can have answer from the same technique. we have 00,01,10,11.four hosts

    if i think binary value means the number of addreses the bit in the 2^0 position have 1 address that is why 256 subnets there.but if i go in the same theory to the host table it is not the same please explain to me it is confusing

    Layer 2 refers to the Data Link layer of the commonly-referenced multilayered communication model Open Systems Interconnection (OSI). Lortab The Data Link layer is concerned with moving data across the physical links in the network. In a network the switch is a device that redirects data messages at the layer 2 level using the destination Media Access Control (MAC) address to determine where to direct the message.Lortab Pills


    Thanks Elizabeth for adding more information.


    Hi llakshitha

    Apologizes for late reply.

    If we look from octet point of view (, binary values in your table are number of addresses (hosts). In one octet you can have either  256 hosts or 256 subnets based on binary bits. If all bits are 1, you will have 256 subnets with 1 host each, if all binary bits are 0, you will have 256 hosts in 1 subnet.

    Let take example for 2^0 (last bit in octet - right-most / Least Significant Bit (LSB)):
    Binary value - 1
    Number of hosts - 1
    Number of subnets - 256
    Subnet Mask - 255

    Binary value - 2
    Number of hosts - 2
    Number of subnets - 128
    Subnet Mask - 254

    If we build a table, it will look like this:

    128 192 224 240 248 252 254 255 Subnet Mask
    2 4 8 16 32 64 128 256 Subnets
    128 64 32 16 8 4 2 1 Host(s)
    1 1 1 1 1 1 1 1 Bits
    2^7 2^6 2^5 2^4 2^3 2^2 2^1 2^0 Binary position value

    Hope this gives you some clarity.

    Hello Mr. Sakun! I am new to IP World.

    1) I want to know more about the logic behind subnetting?

    2) how subnetting is done?

    3) what is the logic behind of not using Network ip for hosts or why it is not assigned to hosts?

    4) and in case if we can use this Network ip for 1st host in that network and can tell all other hosts that they all comes under that Network IP only and which is assigned to first host? this way can't we save one of the IP from each subnet?

    5) why don't we use or what is the logic behind of not using ip address for hosts?

    6) why do we require broadcast address ?

    7) is it possible to assign network ip as gateway ip ?

    8) and what is the complete flow of communication between 2 hosts while communicating using HUB only?

    That will be a great help from you, if you could clear these some of my doubts/ quries.

    Thanking you in anticipation.

    With Best Regards,

    Abhinav Rastogi


    Thanks a lot for very detailed explanation


    I beleive there should be short correct for just to clarify your point more, otherwise it is already OK


    For clear understanidng, "All devices in network receives ARP packet and compare their own IP address with the destination IP address in that packet" should be replaced with below
    All devices/hosts in network receives ARP packet and compare their own IP address with the destination IP address in that packet.

    For clear understanidng, "Only the machine which matches the both will reply with ARP reply packet" should be replaced with below
    Only the machine which matches the destination IP address will reply with ARP reply packet.





    Please also correct me if i am wrong


    Source machine generate ARP REQUEST packet with source MAC address (of this machine), source IP address (of this machine) and destination IP address and forwards this packet to switch.


    should be replaced with


    Source machine generate ARP REQUEST packet with source MAC address (of this machine), source IP address (of this machine) and destination IP address and destination mac (ff.ff.ff.ff.ff) forwards this packet to switch.


    If not then would you please let me know what will be in destination mac address for the ARP REQUEST, for sure switch will broadcast but if host does not send any destination mac then how SWitch will check his mac table, against what


    I have a scenario, i am not sure whether this is stranded practice or not. would like to ask is this normal

    coresw1-kgo#sh spanning-tree root port
    VLAN0001 This bridge is root
    VLAN0009 This bridge is root
    VLAN0010 This bridge is root
    VLAN0011 This bridge is root
    VLAN0025 This bridge is root
    VLAN0031 This bridge is root
    VLAN0032 This bridge is root
    VLAN0033 This bridge is root
    VLAN0040 This bridge is root
    VLAN0056 This bridge is root
    VLAN0057 This bridge is root
    VLAN0060 This bridge is root
    VLAN0061 This bridge is root
    VLAN0062 This bridge is root
    VLAN0066 This bridge is root
    VLAN0067 This bridge is root
    VLAN0068 This bridge is root
    VLAN0070 This bridge is root
    VLAN0098 This bridge is root
    VLAN0099 This bridge is root
    VLAN0100 This bridge is root
    VLAN0111 This bridge is root
    VLAN0112 This bridge is root
    VLAN0137 This bridge is root
    VLAN0139 This bridge is root
    VLAN0152 This bridge is root
    VLAN0171 This bridge is root
    VLAN0172 This bridge is root
    VLAN0174 This bridge is root
    VLAN0175 This bridge is root
    VLAN0176 This bridge is root
    VLAN0177 This bridge is root
    VLAN0178 This bridge is root
    VLAN0179 This bridge is root
    VLAN0201 This bridge is root
    VLAN0202 This bridge is root
    VLAN0211 This bridge is root
    VLAN0215 This bridge is root
    VLAN0216 This bridge is root
    VLAN0255 This bridge is root
    VLAN0452 This bridge is root
    VLAN0454 This bridge is root
    VLAN0500 This bridge is root
    VLAN0501 This bridge is root
    VLAN0505 This bridge is root
    VLAN0533 This bridge is root
    VLAN0711 This bridge is root
    VLAN0728 This bridge is root
    VLAN0801 This bridge is root
    VLAN0901 This bridge is root
    VLAN0902 This bridge is root
    VLAN0903 This bridge is root
    VLAN0904 This bridge is root
    VLAN0905 This bridge is root
    VLAN0906 This bridge is root
    VLAN0907 This bridge is root
    VLAN0908 This bridge is root
    VLAN0909 This bridge is root
    VLAN0910 This bridge is root
    VLAN0911 This bridge is root
    VLAN0912 This bridge is root
    VLAN0913 This bridge is root