Showing results for 
Search instead for 
Did you mean: 
Sakun Sharma

General Overview of Layer 2

Layer 2 is Data Link Layer (DLL) as per OSI Model. As we know function of each layer is to provide services to above layer, so DLL provide various services to Layer 3: Network Layer. Various services which DLL provides are:

  • Framing network layer data packets.
  • Flow Control
  • Multiple Access control using CSMA/CD (Carrier Sense Multiple Access / Collision Detection) in wired network and CSMA / CA (Collision Avoidance) in wireless network.
  • Physical Addressing
  • Switching
  • Quality of Service (QoS)
  • Virtual LAN’s (VLAN)

             & some more.

Data Link Layer is basically divided into two sub-layers:

  • Logic Link Control (LLC): Provide services to upper layer.
  • Media Access Control (MAC): Perform Layer 2 functions like switching, physical addressing etc.

Basically what I am going to explain in this article is, how inter-communication happens in data network between two devices at Layer 2 (Switching).

Physical Addressing and Switching

Network is a group of devices connected to each other. On Layer 2, devices can communicate within a single network only. Layer 2 devices cannot span multiple networks, for multiple networks Layer 3 support is required.  Each device in a single network needs to be identified uniquely. At Layer 2, unique identification is done via physical addressing scheme. Device hardware (NIC Card) which provides interconnection has unique physical address assigned to it known as MAC Address. MAC address is of 48 bits, written in hexadecimal form separated after 8 bits with either colon (:) or hyphen (-). Example address: 00:80:48:5C:1A:52. So each machine will have unique physical address by which machine is identified. Total MAC Address is of 6 bytes. Each manufacturer is allotted with first 3 bytes of MAC Address which act as series prefix for all the NIC’s by that company, last 3 bytes are unique within one series. By this way no MAC address of one company can clash with another nor within company series.  Communication among devices at layer 2 is done via some interconnecting device, which forms connection between each host machine or network devices (router, wireless, etc). Switch is that device which provides interconnection. Switch has ports (physical interface) at which wires from various network devices or host machines connect. All devices in a network are connected to a switch which interconnects them; this is Layer 1 (inter-connection).  Now let’s get into deep understanding about how communication is done after interconnection. For this we need to understand working of switch.

Working of Switch

Switch is an interconnecting device with 16 or 24 ports in common. All other devices are connected to these ports. Whenever any machine sends packet to any other machine, source machine send packet to switch, switch then forwards it to destination machine. Each packet which comes to switch contains source and destination physical address in it, on basis of which switch forwards packet to other machine. Switch always sent packet based on destination MAC address. Its process is as follows: (process also known as Switching)

  • When switch receives a packet from any device, it checks for its destination MAC address.
  • Then switch compares destination MAC address with its MAC Address Table for corresponding MAC address.
      • If MAC Address is found, packet is sent out to port against which MAC Address was matched.
        • If entry is not found, Unknown  unicasts (when the switch  doesn't have a port mapping for a destination  mac address in the frame)  are treated like broadcasts by Layer Two  devices, and are flooded out  of all ports except the port on which the  frame originated.

    Now question comes, how does switch knows on which port destination machine is connected? For this switch uses one table in its cache memory called MAC Address table or Forwarding Table in which switch stores that at which port which machine is connected by storing its physical address (MAC Address). So table contains two columns (Physical Address and Port Number) and rows equal to number of ports in switch.  When switch is turned ON, by default there is no entry in MAC address table, as communication starts, based on devices involved entries are created in table. 

    Working of Address Resolution Protocol (ARP)

    ARP is a layer 2 protocol, used for obtaining MAC address of any devices within a network. Host machines use ARP protocol to obtain MAC Address. ARP protocol in conjunction with Layer 3 IP Protocol addressing (IP Address).  Host machine uses ARP because when machine needs to send packet to another device, destination MAC address is needed to be written in packet sent, so host machine should know the MAC Address of destination machine. Operating Systems also maintain ARP Table (MAC Address Table).  To obtain MAC address, ARP performs following process: (ARP request by host machine)
    • Source machine generate ARP REQUEST packet with source MAC address (of this machine), source IP address (of this machine) and destination IP address and forwards this packet to switch.
    • Switch receives the incoming packet and reads the source MAC address and checks its MAC address table, if entry for packet at incoming port is found then it checks its MAC address with the source MAC address and updates it, if entry not found then switch add and entry for incoming port with MAC address.
    • All ARP REQUEST packets are broadcasted in network, so switch broadcast ARP REQUEST packet in network.
    • (Broadcast are those packets which are sent to everyone in network except the sender, only in network to which it belongs, it cannot span multiple networks)
    • All devices in network receives ARP packet and compare their own IP address with the destination IP address in that packet.
    • Only the machine which matches the both will reply with ARP reply packet. This packet will have source IP of this machine (which was destination machine in previous packet, as now its replying this machine will be the source machine) , source MAC address, destination MAC address (same as source MAC address in REQUEST packet) and destination IP address (same as source IP address in REQUEST packet).
    • Then switch reads the ARP reply message and add entry in its MAC Address Table for port number on which it has received packet by reading its source MAC address field and forwards that packet to destination machine (source machine in REQUEST packet) as its MAC is in destination MAC address.
    • Further host machine add destination machine entry into its ARP table.
    This using ARP resolution switch and other devices in network obtain MAC address of any other device in a network. Remember ARP works on broadcast, so it works only in single network.

    Final Layer 2 Communication Process

    Now finally let’s see how devices communication occur at Layer 2.  Example Newtork Suppose Machine A needs to communicate with Machine D, following will be the process at Layer2:

    Summary Process

    • Machine A lookup’s for Machine D MAC address in its ARP table.

      • If MAC Address found then packet is formed and sent to Switch A.
      • If MAC address not found then ARP Request is generated and MAC address is obtained.

    • Switch A receives packet and checks for MAC Address in its MAC Address Table.

      • If MAC Address matched it will forward packet on matched port number.
      • If MAC Address not found then the packet is broadcasted to all ports, except on which it has received the packet.

    • Machine D receives packet from Switch A which was sent by Machine A.
    • When Machine D will reply, same process will be followed as switching is done.

    Detailed Process

    • Machine A lookup’s for Machine D MAC address in its ARP table. If MAC address is not found, machine A will send ARP Request for MAC address of machine D (using Machine D IP Address) and sends packet of Switch A.
    • Switch A will receive and read packet and add Machine A physical address in its MAC Address table to which Machine A is connected.
    • After that, switch will broadcast ARP Request packet in network.
    • All machines in network except Machine A will receive ARP Request packet. Then all machines will check for Destination IP address and compare with its own IP Address.
    • Only Machine D IP address matches with destination IP address as packet was intended for that machine.
    • Machine D will reply with its MAC Address (as per ARP working).
    • Switch A receives ARP Reply packet, and will add physical address of Machine D in its MAC Address table against corresponding port on which it received reply.
    • After adding entry it will check for destination MAC Address and compare it with its MAC address table.
    • Based on MAC Address table entry, it will forward packet to corresponding port number against which successful match was found.
    • Host machine will receive ARP Reply and add MAC address to its ARP table.
    • Then machines forms complete data packet and sends it to Switch A.
    • Switch A receives packet and updates it’s MAC Address Table and based on Destination MAC Address match with its MAC Address Tables, forwards packet on corresponding port.
    • In same manner other machine will reply and same process will repeat as point 12 and 13.
    Unknown  unicasts (when the switch  doesn't have a port mapping for a destination  mac address in the frame)  are treated like broadcasts by Layer Two  devices, and are flooded out  of all ports except the port on which the  frame originated
    Community Member

    In detailed process, there is one error on the 7th line last word.....It's not "on which it received request" rather "on which it received reply" and it was good explanation.... One thing I would like to ask is that What will happen in a situation in which a PC 'A' is making a arp request to PC 'B' both connected to a layer 2 switch (same switch) and switch already know the mac address of PC 'B'.... Will the layer 2 switch respond to the arp query of PC 'A' by providing it the mac address of PC 'B' and no need to broadcast frame....? Please let me know as this argument was heated between me and my trainer in CCNP lecture..

    Sakun Sharma

    Hi Naresh,

    Thanks for correcting me.

    And about your question, Switch will not reply for the ARP request generated by PCA, it will broadcast the ARP request and only PCB will reply for the ARP Request packet.

    We know that device check for the IP address in the ARP packet, so it matches only for PC B, so only PC B will reply for the ARP Request generated by PC A even when switch knows the PC B MAC Address.


    Sakun Sharma

    Community Member

    I want to say this was the clearest explaination of a common layer 2 working example while providing all the needed information about the involved technologies.

    I appreciate your simple but powerful write!



    Sakun Sharma

    Thank You. :)



    Sakun Sharma

    Community Member

    Hi Sakun,

    You said, switch will not reply for the ARP request generated by PC A. Afaik, switch maintains ARP table, so when it gets ARP reqeust from PCA, wouldn't it check its ARP table and send ARP reply?

    If not, may I know the purpose of ARP table in switch.

    Looking forward for the answer.



    Harish Bhat

    Sakun Sharma

    Hi Harish,


    No switch will never reply back for any ARP request because Switch do not have sufficient information to do that, that means switch cannot reply even if it wants to.


    ARP - Address Resolution Protocol - It is a Layer 3 address (IP Address) to Layer 2 address (MAC address) mapping, means IP to MAC mapping. It is required because devices in Local network communicate over MAC address.


    Now in ARP request Source machine basically ask what is the MAC address of the machine which has this particular IP Address. Swiches has MAC address table in which it maps, port number of switch with MAC address. Switches never know what is the IP Address of that machine, because Switch is a Layer 2 device.


    So that is why Switch never reply back to ARP request, because which does not understands IP Address, so switch never knows which IP is which MAC address.


    Switches has MAC address table to make forwarding decision, which frame need to be forwared to which port number, that is why Switches have MAC address. If Switches do not have MAC address table, every frame they will receive, it will simple flood (Broadcast) that frame, same as HUB, which will again be a huge performance degradation.


    For detailed working of ARP and Switch working, you can go through my video tutorial from the below link:




    Sakun Sharma

    Community Member

    Thanks Sakun for the detailed explanation. I still left with ambiguous question as to why switch has ARP table? and what is the use of it?

    Sakun Sharma

    Switches do no have ARP table instead they have MAC Address Table, where as in Operating Systems like Windows, Linux, MAC we have ARP Table.

    ARP Table - IP to MAC mapping (Layer 3 to Layer 2 Mapping)

    MAC Address Table - MAC Address to Port Number mapping (Layer 2 to Layer 1 Mapping)


    Switches are interconnecting devices which are advance version of HUB. In case of HUB which was Layer 1 device, whenever it receive any signal on any port, it simple replicate the same electrical signals on other ports except on which it has received.

    Problem with HUB:
    1. Broadcasting nature

    2. Security Issue because everyone is receiving the data

    3. Shared bandwidth - only one device can send data at one time, if multiple tries, it results in collision.



    Switches works on Layer 2, meaning Switches can understand MAC address.

    MAC Address Table

    It is a table in Switch memory in which it keep record on what port which machine is connected by storing the machines MAC address with the port number. That means, it has mainly two columns - Port Number and MAC Address. Ex. Port 1 - 00:0E:46:34:FE:3F

    Working of a Switch:

    1. Whenever Switch receive any frame from on any port, Switch will open the Ethernet Frame and look Destination MAC Address.

    2. Switch will look in its MAC Address table and search for destination MAC address.

    3. If Switch finds the MAC address in Table, Switch forward frame only on the port on which that machine is connected based on MAC Address Table entry which is unlike HUB which broadcast every frame.

    4. If Switch cannot find destination MAC address in the table, in that case, Switch will flood (Broadcast) that frame.


    So MAC Address table helps switch to make forwarding decision, that which frame need to be forward to which port number (unicasting nature), instead of broadcasting.


    Switch Benefits:

    1. Unicast nature (one-to-one communication)

    2. More secured than HUB - as not everyone receive every frame

    3. Non-shared bandwidth, each port has its own bandwidth.


    Hope this helps.



    Sakun Sharma

    Community Member

    Thanks Sakun for confirming that Switches do not have ARP table.

    Community Member

    Hi Sakun,

    Actually I have doubt, you said that switches do not maintain ARP table, but I have seen switches that maintain ARP table. So, My question is does layer 2 and layer 3 switchs maintain ARP table or not.

    looking forward for answer.

    Thanks and Regards,

    Vaibhav Verma

    Sakun Sharma

    Hi Vaibhav,


    Yes from switching perspective there is no role of ARP table, but switches do maintain an ARP table.

    Layer 3 Switches are the one which will have large ARP table and records of the machines connected in your network if its an Inter-VLAN routing switch, else managed switches on which you can configure IP Address for management maintain a small ARP table like host machines do, just to communicate to devices in management Vlan.



    Community Member

    Hi Sakun,

    Thanks Sakun, for clearing my doubt.


    Community Member

    Hi Sakun,

    I have a question w.r.t multiple mac address associated on a switch port.

    This is the case with Virutal Machines running on the host.

    Lets take an example of VMware, where and ESXi host has multiple VM's running and each having its own MAC address.

    Please see the attachment. The VM's are connected to Virtual switch ports and the virtual uplink port of the switch is connected to physical NIC which inturn is connected to physical switch.

    As per VMware, when we create virtual switch the default option "Notify switches" is set to "yes", which means the ESXi host sends RARP packet with source MAC address as the VM and destination MAC address as FF(broadcast) for all of the VM's connected to virtual switch.

    With this the physical switch knows that whenever it receives any frame destined to any of the above VM, it has to forward the traffic to the physical NIC where the ESXi host is connected.

    My question is, will Switch maintains multiple MAC addresses per port?

    I guess this scenario is also possible, when switches are interconnected to each other and multiple mac addresses are maintained per port.

    can you please clarify on this?




    Community Member

    hi sakun,

    my question is by ARP request switches can understand the mac address. so every time pc try create a packet he send a ARP.(if mac doesnt found in arp table of os) so by that ARP switch will learn mac of the source and by reply arp switch will learn destination mac. in this moment frame reach destination without any trouble. 

    what happens if frame comes to the switch and now switches doesn't have a mac? (lets assume that though it learn source and mac by arp now he update mac table). does switch flood that frame? if he flood frame goes to every port. so how other nic s drop that packet and get the correct nic?

    because when arp there reply came and they can figure out this is the destination. now they cant. 

    please figure out this for me.

    Sakun Sharma

    Hi Harish,

    Yes switches can store multiple MAC address on one port.

    In your case, switch will store all the VM's MAC Address on the same physical port in its MAC address table. When you run command 'show mac address-table', it will list all VM's MAC addresses associated with that one port. If you want to check MAC Addresses associated with a single port you can also use command 'show mac address-table | in Gi0/0/1'.

    Just for information, one switch port can have multiple devices MAC addresses associates, but one device MAC address can be associated to only one port, switch cannot have one MAC on two different ports. If it learns same MAC on a different port, it removes old port entry and add a new port entry for the same MAC.

    Kind Regards,


    Getting Started

    Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

    Quick Links