Layer 2 and Ethernet

The data link layer (OSI Layer 2) sits between the physical layer and the network layer. Its Responsibilities are concrete and well-defined:

1. Framing. Encapsulate network-layer packets into a frame with header and trailer fields that allow the receiver to identify where each frame begins and ends on the wire.
2. MAC addressing. Provide a unique identifier for each interface on a LAN so that frames can be delivered to the correct destination.
3. Error detection. Detect (but not correct) bit errors introduced during transmission using a Frame Check Sequence (FCS).
4. Flow control. Prevent a fast sender from overwhelming a slow receiver (relevant in half-duplex environments, less so in modern full-duplex switched LANs).
5. Media access control. Determine which device may transmit on a shared medium and when (CSMA/CD for classic Ethernet).

Layer 2 does not provide routing. It provides node-to-node delivery within the same broadcast Domain. If the destination MAC is not on the local segment, the frame is sent to the default gateway (router), and Layer 3 handles inter-network delivery.

Layer 2 builds on Layer 1 (physical layer) by adding structure to the raw bit stream. It receives Bits from the physical layer, groups them into frames, and passes the extracted payload up to Layer 3. Conversely, it takes Layer 3 packets, wraps them in a frame, and hands the resulting bit Pattern to Layer 1 for transmission.

The Layer 2 header contains the destination and source MAC addresses. The Layer 3 header contains The destination and source IP addresses. Both are needed for a frame to traverse a LAN and for the Receiving host to process the packet correctly.

The original Ethernet was developed at Xerox PARC by Robert Metcalfe, David Boggs, and others in the Mid-1970s. The first commercial specification was published in 1980 by a consortium of DEC, Intel, And Xerox — hence “DIX Ethernet” or “Ethernet Blue Book.” This is often called “Ethernet V1” or “DIX Ethernet.”

Key characteristics of DIX Ethernet:

• 10 Mbps over thick coaxial cable (10BASE5)
• CSMA/CD access method
• 48-bit MAC addresses
• Frame length: 64 to 1518 bytes

The IEEE standardized Ethernet as 802.3. This created a subtle but important divergence: the IEEE Version uses a Length field (where the value $\le$ 1500 indicates an IEEE 802.3 frame), while DIX Ethernet II uses an EtherType field (where the value $\ge$ 1536 indicates the upper-layer protocol).

In practice, the industry converged on Ethernet II framing. When you see an Ethernet frame on a Modern network, it is almost certainly Ethernet II (also called DIX Ethernet), not 802.3 with SNAP Or 802.2 LLC.

Each generation maintained backward compatibility at the physical layer while dramatically Increasing throughput. The shift from shared medium (coax, hubs) to switched (full-duplex point-to- Point links) was the most operationally significant change.

Every Ethernet frame transmitted on a LAN follows the same structure. The frame is transmitted Most-significant byte first on the wire (big-endian bit order within each byte).

+----------+-----+-------------+------------+-----------+---------+-----+
| Preamble | SFD | Dest MAC    | Src MAC    | EtherType | Payload | FCS |
| 7 bytes  | 1 B | 6 bytes     | 6 bytes    | 2 bytes   | 46-1500 | 4 B |
+----------+-----+-------------+------------+-----------+---------+-----+
|<---        8 bytes        --->|<----      14 bytes              --->|
|<--------                    64 - 1518 bytes total               -------->|

The preamble consists of 7 bytes of alternating 1s and 0s: 10101010 repeated 7 times (56 bits). Its purpose is to allow the receiver”s clock to synchronize with the transmitter”s clock. The Preamble is not counted as part of the frame for minimum/maximum size calculations.

The SFD is a single byte: 10101011. The last two bits signal the end of the preamble and the start Of the actual frame. The receiver uses this byte to identify exactly where the destination MAC Address begins.

The 48-bit MAC address of the intended recipient. Can be unicast, multicast, or broadcast.

The 48-bit MAC address of the sender. Always unicast (a frame should never be sourced from a Multicast or broadcast address).

Identifies the protocol encapsulated in the payload. Common values:

When the value is $\le$ 1500 (0x05DC), the field is interpreted as a Length field (802.3 frame) Rather than an EtherType, and the encapsulated protocol is identified by the LLC/SNAP header.

The encapsulated Layer 3 (or Layer 2.5) data. The minimum of 46 bytes exists to ensure that the Total frame (excluding preamble/SFD) is at least 64 bytes, which is required for CSMA/CD collision Detection to work correctly. If the actual data is shorter than 46 bytes, padding bytes are added.

The maximum transmission unit (MTU) for standard Ethernet is 1500 bytes. Jumbo frames extend this to 9000 bytes or more, but require support on every device in the path.

A 32-bit CRC (Cyclic Redundancy Check) computed over the entire frame (from Destination MAC through The end of the Payload). The FCS is appended by the sender and verified by the receiver. If the CRC Does not match, the frame is silently dropped. Layer 2 does not request retransmission — that is TCP’s responsibility (Layer 4).

The CRC-32 polynomial used is:

This polynomial can detect all single-bit errors, all double-bit errors, any odd number of errors, And any burst error of 32 bits or fewer.

A MAC address is a 48-bit identifier written in hexadecimal as six groups of two digits Separated by colons or hyphens:

00:1A:2B:3C:4D:5E    (colon notation -- common on Linux/macOS)
00-1A-2B-3C-4D-5E    (hyphen notation -- common on Windows)
001A.2B3C.4D5E       (dot notation -- Cisco)

The first three octets form the Organizationally Unique Identifier (OUI), assigned by IEEE to Hardware manufacturers. The last three octets are assigned by the manufacturer to each individual Interface.

OUI lookup example:

• 00:1A:2B — assigned to a specific vendor
• F8:FF:0A — another vendor’s prefix

The first byte of the MAC address contains two special bits:

Bit 0 (LSB of first byte): I/G (Individual/Group)
  0 = Unicast (intended for a single specific host)
  1 = Group (multicast or broadcast)

Bit 1: U/L (Universally/Locally administered)
  0 = Universally administered (assigned by IEEE, burned into NIC)
  1 = Locally administered (assigned by network administrator)

For example, if the first byte is 0x0A:

Binary: 0000 1010
Bit 0 (I/G): 0 -> Unicast
Bit 1 (U/L): 1 -> Locally administered

Unicast: Frame is destined for a single specific NIC. The I/G bit is 0.

Broadcast: Frame is destined for all devices on the LAN. The destination MAC is FF:FF:FF:FF:FF:FF. The I/G bit is 1.

Multicast: Frame is destined for a group of devices that have registered for a particular Multicast group. In Ethernet, multicast addresses have the I/G bit set to 1, meaning the least Significant bit of the first octet is 1. For example, 01:00:5E:00:00:01 is a multicast address Used by IPv4 multicast group 224.0.0.1.

Enterprise switches support between 8,000 and 1,000,000+ MAC address table entries. When The table fills, new addresses either replace the oldest entries (LRU eviction) or cause the switch To flood frames to all ports, degrading performance. Plan your network segmentation accordingly.

Carrier Sense Multiple Access with Collision Detection (CSMA/CD) is the media access control method Used in half-duplex Ethernet. It is defined in IEEE 802.3 and is the reason for the 64-byte minimum Frame size.

The algorithm works as follows:

1. Carrier Sense. Before transmitting, a station listens to the medium. If the medium is busy, the station defers and waits until it is idle.
2. Multiple Access. Multiple stations share the same medium. Any station can transmit when the medium is idle.
3. Collision Detection. While transmitting, the station monitors the medium. If it detects a signal that differs from what it is sending (indicating another station is transmitting simultaneously), a collision has occurred.

When a collision is detected:

1. The station sends a 32-bit jam signal to ensure all stations on the segment detect the collision.
2. Both stations stop transmitting.
3. Each station selects a random backoff period using the binary exponential backoff algorithm.
4. After the backoff period, the station attempts to retransmit.

After the $n$-th collision ($n = 1, 2, 3, \ldots$), the station picks a random integer $r$ uniformly From the range $\{0, 1, \ldots, 2^k - 1\}$ where:

The station waits for $r \times 512$ bit times before retransmitting. A “bit time” at 10 Mbps is 100 Nanoseconds, so each slot time is 512 \times 100\mathrm{ ns = 51.2\,\mu\mathrm{s.

The maximum backoff occurs after 10 collisions: $k = 10$Giving a range of $\{0, 1, \ldots, 1023\}$. After 16 consecutive collisions, the station gives up and reports an error to the upper layer.

The minimum frame size of 64 bytes (46 bytes payload + 14 bytes header + 4 bytes FCS) is directly Tied to CSMA/CD. The worst-case round-trip propagation delay on a 10 Mbps Ethernet segment (2500 m With 4 repeaters) is approximately 51.2 microseconds, which is exactly 512 bit times. A station must Be able to detect a collision before it finishes transmitting the minimum-size frame. At 10 Mbps, Transmitting 64 bytes takes:

This ensures that any collision on the segment will be detected before the transmitting station Finishes sending the minimum frame. If the frame were shorter, a station at one end of the segment Might finish transmitting before the collision signal from the far end arrives, leading to an Undetected collision.

Full-duplex Ethernet eliminates collisions entirely because each station has dedicated transmit and Receive paths. A switch port connected to a single host is inherently full-duplex — there is no Shared medium to contend with. CSMA/CD is disabled on full-duplex links.

Half-duplex only exists when a hub is in the path. Hubs are physical-layer repeaters that forward All received signals to all other ports. Every port on a hub is in the same collision domain. Hubs Have been obsolete for over two decades.

Fiber optic Ethernet variants are common in data center and campus backbone deployments:

Gigabit Ethernet over copper (1000BASE-T) uses all four pairs of a Cat5e cable, with bidirectional Signaling on each pair. Unlike 10BASE-T and 100BASE-TX, which use separate pairs for transmit and Receive, 1000BASE-T uses digital signal processing to separate the simultaneous transmit and receive Signals on each pair. This is achieved through echo cancellation and hybrid circuits.

The symbol rate is 125 MBd (125 million symbols per second), and each symbol encodes 2 bits using PAM-5 modulation (5 amplitude levels: -2, -1, 0, +1, +2). However, trellis coding and 4D-PAM5 Encoding effectively transmit 1 byte per symbol across all four pairs:

A Layer 2 switch operates at the data link layer. Its primary functions are:

1. Learning. When a frame arrives on a port, the switch records the source MAC address and the incoming port in its MAC address table (also called a CAM table — Content Addressable Memory).
2. Forwarding. When a frame arrives, the switch looks up the destination MAC address in its table. If found, it forwards the frame only out the port associated with that MAC. If not found, it floods the frame out all ports except the incoming port (unknown unicast flooding).
3. Filtering. If the destination MAC is found and the associated port is the same as the incoming port, the switch drops the frame (the destination is on the same segment as the source).

The MAC address table maps MAC addresses to switch ports:

MAC Address          Port    VLAN   Age
-------------------  ------  -----  ------
00:1A:2B:3C:4D:5E   Gi0/1   10     120
00:1A:2B:3C:4D:5F   Gi0/2   10     85
00:1A:2B:3C:4D:60   Gi0/5   20     200
FF:FF:FF:FF:FF:FF    --      --     --     (never learned)

MAC address table entries have an aging timer (default: 300 seconds on Cisco switches). If a MAC Address is not seen in frames arriving on its associated port within the aging period, the entry is Removed. This handles cases where devices are moved to different ports or removed from the network.

Static MAC entries can be configured to prevent aging:

mac address-table static 00:1A:2B:3C:4D:5E vlan 10 interface Gi0/1

A switch floods the following frame types to all ports in the same VLAN (except the incoming port):

• Unknown unicast. The destination MAC is not in the MAC address table.
• Broadcast. The destination MAC is FF:FF:FF:FF:FF:FF.
• Multicast. The destination MAC has the I/G bit set (unless IGMP snooping is enabled).

Flooding is necessary but can be wasteful. Large broadcast domains with excessive flooding degrade Performance. This is one of the primary reasons for VLAN segmentation.

An attacker can fill a switch’s MAC address table by sending frames with random source MAC Addresses. When the table is full, the switch can no longer learn legitimate addresses and must Flood all frames, effectively turning the switch into a hub. This allows the attacker to capture Traffic from other VLANs on the same switch (if port security is not configured).

Countermeasures:

• Port security: Limit the number of MAC addresses learned per port.
• Dynamic ARP inspection (DAI): Validate ARP packets.
• DHCP snooping: Track legitimate MAC-to-IP bindings.

A Virtual Local Area Network (VLAN) is a logical broadcast domain created at Layer 2. Devices in the Same VLAN can communicate with each other as if they were on the same physical switch, even if they Are on different switches. Devices in different VLANs cannot communicate at Layer 2 — they require A router (Layer 3 device) for inter-VLAN routing.

IEEE 802.1Q inserts a 4-byte tag between the Source MAC and the EtherType field:

+----------+----------+-----------+-------------+-----------+---------+-----+
| Dest MAC | Src MAC  | 802.1Q    | EtherType   | Payload   | FCS     |
| 6 bytes  | 6 bytes  | Tag       | 2 bytes     | 46-1500   | 4 bytes |
|          |          | 4 bytes   |             |           |         |
+----------+----------+-----------+-------------+-----------+---------+-----+
                      |TPID|PCP|DEI|    VID     |
                      |2B  |3b |1b |   12 bits  |

• TPID (Tag Protocol Identifier): 0x8100 — identifies this as an 802.1Q tagged frame.
• PCP (Priority Code Point): 3 bits — used for QoS (802.1p). Values 0-7 map to traffic classes.
• DEI (Drop Eligible Indicator): 1 bit — marks frames eligible for dropping during congestion.
• VID (VLAN Identifier): 12 bits — identifies the VLAN (0-4095). VID 0 is reserved, VID 4095 is reserved. Usable range: 1-4094.

The tagged frame increases the maximum frame size from 1518 to 1522 bytes. This is sometimes called A “jumbo” frame by older devices that do not support 802.1Q, but modern switches handle it Correctly.

Configuration example (Cisco):

! Access port
interface Gi0/1
  switchport mode access
  switchport access vlan 10

! Trunk port
interface Gi0/24
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30
  switchport trunk native vlan 99

The native VLAN is the VLAN assigned to untagged traffic on a trunk port. By default, Cisco switches Use VLAN 1 as the native VLAN. Best practice is to change the native VLAN to an unused VLAN (e.g., VLAN 999) and prune VLAN 1 from all trunks.

If the native VLAN mismatches between two switches on a trunk, the switches will still form a trunk, But traffic on the native VLAN will not be tagged, leading to potential security issues and Connectivity problems.

VLAN hopping is an attack where an attacker sends traffic from one VLAN to another without a router.

Double tagging attack: The attacker sends a frame with two 802.1Q tags. The first switch (with a Matching native VLAN) strips the outer tag and forwards the frame. The second switch sees the inner Tag and forwards the frame to the target VLAN.

Prevention:

1. Do not use the native VLAN for any legitimate traffic. Set the native VLAN to an unused, dedicated VLAN (e.g., VLAN 999).
2. Explicitly tag the native VLAN: switchport trunk native vlan tag (Cisco IOS 15.2+).
3. Prune unnecessary VLANs from trunks: switchport trunk allowed vlan 10,20,30.
4. Disable unused ports and place them in a dead VLAN:

   interface range Gi0/1-23
     shutdown
     switchport mode access
     switchport access vlan 999

STP (IEEE 802.1D) prevents Layer 2 loops in networks with redundant paths. Without STP, a loop Creates a broadcast storm: frames circulate indefinitely, consuming all bandwidth and bringing down The network.

STP elects a single root bridge for the entire bridged network. All paths lead to the root bridge, And STP blocks redundant paths.

The root bridge is the switch with the lowest Bridge ID (BID):

The default bridge priority is 32768. The priority is configurable in increments of 4096: 0, 4096, 8192, …, 61440.

spanning-tree vlan 1 priority 4096

The total time from blocking to forwarding is the max age (20 s) + 2 x forward delay (30 s) = 50 seconds in the worst case. This is painfully slow for modern networks.

STP uses BPDUs to exchange topology information. There are two types:

• Configuration BPDU: Sent by the root bridge every 2 seconds (hello time). Contains the root BID, root path cost, sender BID, and port IDs.
• TCN (Topology Change Notification) BPDU: Sent by a non-root bridge when it detects a topology change (port going up/down).

Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) reduces convergence time from 50 seconds to a few Seconds or less. Key improvements:

RSTP uses a proposal/agreement mechanism: when a port becomes designated, it proposes itself as the Forwarding port. The downstream switch acknowledges (agrees) only if all its non-edge ports are in Sync (blocking or discarding). This allows rapid convergence without waiting for timers.

PortFast (on Cisco) should be enabled on all edge ports (end devices) to skip the listening/learning States:

interface Gi0/1
  spanning-tree portfast
  spanning-tree bpduguard enable

BPDU Guard shuts down the port if a BPDU is received, preventing an attacker from introducing a Rogue switch that could become the root bridge.

Link aggregation (also called port channeling, bonding, or teaming) combines multiple physical links Into a single logical link. This provides:

• Increased bandwidth. Aggregate throughput of all member links.
• Redundancy. If one link fails, traffic is redistributed to the remaining links.
• Load balancing. Traffic is distributed across member links using a hash algorithm.

The Link Aggregation Control Protocol (LACP) is defined in IEEE 802.3ad (originally) and superseded By 802.1AX. LACP provides dynamic negotiation of link aggregation groups between two devices.

Each port has an LACP port priority (default 32768, configurable in increments of 1) and an Administrative key. Ports with the same key on the same device form a LAG (Link Aggregation Group).

• Active: Actively sends LACPDU frames to negotiate aggregation.
• Passive: Responds to LACPDUs but does not initiate negotiation. Used when one side should not actively form the LAG.

At least one side must be active for the LAG to form.

Configuration example (Cisco):

interface range Gi0/1-2
  channel-group 1 mode active

interface Port-channel1
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  lacp max-bundle 2
  lacp system-priority 100

LACP distributes traffic across member links using a hash of:

• Source MAC, destination MAC, or both
• Source IP, destination IP, or both
• Source port, destination port, or both (Layer 4)
• A combination of the above

The hash is deterministic — the same flow always maps to the same link. This means traffic from a Single flow cannot exceed the bandwidth of one physical link, regardless of the total number of Links in the LAG.

port-channel load-balance src-dst-ip    ! hash on src+dst IP
port-channel load-balance src-dst-mac   ! hash on src+dst MAC
port-channel load-balance src-dst-port  ! hash on src+dst port (Layer 4)

ARP resolves IPv4 addresses to MAC addresses. When a host needs to send a packet to an IP address on The same subnet, it uses ARP to discover the destination’s MAC address.

1. The sender checks its ARP cache for an existing mapping.
2. If no mapping exists, the sender broadcasts an ARP Request: “Who has 192.168.1.100? Tell 192.168.1.1.”
3. The host with IP 192.168.1.100 replies with a unicast ARP Reply: “192.168.1.100 is at 00:1A:2B:3C:4D:5E.”
4. The sender caches the mapping and sends the Ethernet frame.

ARP packet format:

+----------+----------+-----------+-----------+----------+-----------+
| HTYPE    | PTYPE    | HLEN      | PLEN      | OPER     |           |
| 2 bytes  | 2 bytes  | 1 byte    | 1 byte    | 2 bytes  |           |
| 0x0001   | 0x0800   | 6         | 4         | 1=req    |           |
|          |          |           |           | 2=reply  |           |
+----------+----------+-----------+-----------+----------+-----------+
| Sender MAC (6 bytes)  | Sender IP (4 bytes)                 |
+-----------------------+--------------------------------------+
| Target MAC (6 bytes)  | Target IP (4 bytes)                 |
+-----------------------+--------------------------------------+

A gratuitous ARP is an ARP request (or reply) where the sender and target IP are the same. It is Used for:

1. Duplicate address detection. When a host boots, it sends a gratuitous ARP for its own IP. If another host replies, there is an IP address conflict.
2. ARP cache update. When a host’s MAC address changes (e.g., NIC replacement, failover), it sends a gratuitous ARP to update other hosts’ caches.
3. VRRP/HSRP failover notification. When a virtual router failover occurs, the new active router sends a gratuitous ARP to update the network’s ARP caches.

Proxy ARP allows a router to answer ARP requests on behalf of a host on another subnet. When host A (192.168.1.10) sends an ARP request for host B (192.168.2.20), the router responds with its own MAC Address. Host A then sends frames destined for host B to the router, which forwards them.

Proxy ARP is generally considered a legacy feature. Modern networks use proper subnetting and Routing instead. It can cause confusion because hosts believe remote hosts are on the local subnet.

The ARP cache maps IP addresses to MAC addresses and has a limited lifetime ( 20-60 minutes On Linux, 4 hours on Windows). Viewing the ARP cache:

# Linux
ip neigh show
arp -an

# Windows
arp -a

Entries can be static (permanent) or dynamic (learned via ARP). Static ARP entries are used to Prevent ARP spoofing in small, controlled environments:

# Linux -- static ARP entry
ip neigh add 192.168.1.100 lladdr 00:1A:2B:3C:4D:5E dev eth0 nud permanent

An attacker sends forged ARP replies to associate the attacker’s MAC address with the victim’s IP Address (or the gateway’s IP address). This redirects traffic through the attacker, enabling Man-in-the-middle attacks.

Countermeasures:

• Dynamic ARP Inspection (DAI): Validates ARP packets against a trusted database (DHCP snooping binding table).
• Static ARP entries: For critical devices (gateways, servers).
• ARP monitoring tools: arpwatch, XArp.

An MTU mismatch between two devices on the same path causes black holes for large packets. If a Switch is configured with an MTU of 9000 (jumbo frames) but the endpoint is at 1500, the endpoint Sends packets that the switch can forward, but intermediate devices with 1500-byte MTU may drop Them. If ICMP is blocked, Path MTU Discovery fails and the connection stalls.

Using the default VLAN 1 for any traffic is a well-known risk. Every trunk port carries VLAN 1 by Default, creating an unnecessarily large broadcast domain. Always prune VLAN 1 from trunks and Assign the native VLAN to an unused, dedicated VLAN.

The most common STP mistakes are:

1. No root bridge planning. Leaving the default priority on all switches means the root bridge is elected arbitrarily. The root bridge should be the most central, most powerful switch.
2. BPDU Guard not enabled on edge ports. Without BPDU Guard, any device (or attacker) connected to an edge port can participate in STP and potentially become root bridge.
3. Mixing STP and RSTP. Older devices running 802.1D force the network to fall back to legacy STP timers, negating RSTP’s convergence benefits.
4. Ignoring STP entirely. Some administrators disable STP to “eliminate convergence delays.” This is catastrophic if any physical loop exists in the network.

ARP operates at Layer 2 and only works within the same broadcast domain. If two hosts are on Different subnets, ARP will not reach the destination. The sender must ARP for its default gateway, Not the destination host. A common error is trying to ARP for a remote address and getting no reply.

Without port security, any device can connect to any switch port and start sending traffic. In an Office environment, this means a visitor can plug in a laptop and access the network. In a data Center, it means a compromised server can spoof MAC addresses and potentially bypass network Segmentation.

An Ethernet frame has the following hex dump (starting from the destination MAC):

FF:FF:FF:FF:FF:FF  00:1A:2B:3C:4D:5E  08 06  00 01  08 00  06  04  00 01
00:1A:2B:3C:4D:5E  C0 A8 01 0A  00 00 00 00 00 00  C0 A8 01 14

Identify the destination MAC, source MAC, EtherType, and determine what type of frame this is.

A station on a 100 Mbps Ethernet network has experienced 6 collisions while trying to transmit a Frame. Calculate:

A) The backoff slot range (number of possible slot values). B) The maximum wait time before the next Retransmission attempt. C) The slot time in microseconds.

Given the MAC address 02:AA:BB:CC:DD:EE:

A) Is this a unicast or multicast address? Justify. B) Is this a universally or locally administered Address? Justify. C) What is the OUI, and what is the device-specific portion?

You are configuring a Cisco switch. Requirements:

• Ports Gi0/1-12: VLAN 10 (Engineering)
• Ports Gi0/13-24: VLAN 20 (Sales)
• Port Gi0/25: Trunk to core switch, carrying only VLANs 10 and 20
• Native VLAN on trunk: VLAN 999 (unused)
• Port Gi0/1 should have BPDU Guard enabled

Write the configuration commands.

vlan 10
  name Engineering
vlan 20
  name Sales
vlan 999
  name BLACKHOLE

interface range Gi0/1-12
  switchport mode access
  switchport access vlan 10
  spanning-tree portfast
  spanning-tree bpduguard enable

interface range Gi0/13-24
  switchport mode access
  switchport access vlan 20
  spanning-tree portfast
  spanning-tree bpduguard enable

interface Gi0/25
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  switchport trunk native vlan 999
  spanning-tree portfast trunk

Four switches are connected in a full mesh topology. Their bridge priorities and MAC addresses are:

• SW1: Priority 32768, MAC 00:00:00:00:00:01
• SW2: Priority 16384, MAC 00:00:00:00:00:02
• SW3: Priority 16384, MAC 00:00:00:00:00:03
• SW4: Priority 8192, MAC 00:00:00:00:00:04

A) Which switch is the root bridge? b) If SW4 fails, which switch becomes the root bridge?

A LAG has 4 member links, each operating at 1 Gbps. You are running a backup job that transfers a Single large file from Server A to Server B.

A) What is the maximum throughput the backup job can achieve through the LAG? b) How would you Improve throughput for the backup job? c) What load-balancing method would you use for a web server Handling thousands of short-lived connections?

A server with IP 192.168.1.100 and MAC 00:11:22:33:44:55 is migrated to a new physical server with The same IP but a new MAC address 00:AA:BB:CC:DD:EE. The default gateway (192.168.1.1) still has the Old ARP entry cached.

A) Why might connectivity fail initially? b) How does a gratuitous ARP solve this? c) If the Gateway’s ARP cache timeout is 1200 seconds, what is the maximum downtime without gratuitous ARP?

A standard untagged Ethernet frame carries 1500 bytes of payload. What is the total frame size on The wire when an 802.1Q tag is added? Include all fields.

This topic covers the essential concepts and techniques related to layer 2 and ethernet, including key principles and practical applications.

Key concepts include:

• core concepts and definitions
• key principles and frameworks
• practical applications
• common techniques and methods
• evaluation and critical analysis

A thorough understanding of these concepts, combined with regular practice and review, is essential for mastery of this topic.

Worked examples demonstrating the application of key concepts are covered in the detailed sub-pages linked above.