Data Link Layer — MAC Address, Ethernet, ARP; IP Addressing

Data Link Layer — MAC Address, Ethernet, ARP

MAC Address

MAC Address (Media Access Control Address) = Physical Address = Ethernet Address = Link Address

• Used at the Data Link Layer
• Used to identify every NIC uniquely
• Burned into the ROM part of NIC — once written, cannot be changed
• Also known as "read-only address"

Finding MAC Address:

Windows:    ipconfig /all
Linux/macOS: ifconfig    (or ip addr)

MAC Address Format:

78:4f:43:90:13:d0

• Size: 6 bytes = 48 bits
• Format: 6 pairs of hexadecimal digits, separated by colons or hyphens
• Structure: First 3 bytes = OUI (manufacturer ID); Last 3 bytes = device ID

Example:

78:4f:43 → OUI = Intel Corporation
90:13:d0 → Device-specific identifier

Ethernet Frame Structure

Ethernet is the dominant wired LAN technology (IEEE 802.3).

Ethernet Frame:
+----------+----------+------+--------+------+-----+
| Preamble | Dest MAC | Src  | EtherType/   | FCS |
| (8 bytes)| (6 bytes)| MAC  | Length       |     |
|          |          | (6B) | (2 bytes)    | (4B)|
+----------+----------+------+---------+----+-----+
                                       |Payload |
                                   (46-1500 bytes)

Minimum frame size: 64 bytes (collision detection requirement)
Maximum frame size: 1518 bytes (without VLAN tag)

ARP — Address Resolution Protocol

ARP resolves IP addresses to MAC addresses within a LAN.

Problem: You have the IP address of a device (e.g., 192.168.1.5) but need its MAC address to send an Ethernet frame.

ARP Process:

Step 1: ARP Request (Broadcast)
  Device A broadcasts: "Who has IP 192.168.1.5? Tell 192.168.1.1 (my MAC: AA:BB:CC:DD:EE:FF)"
  All devices on LAN receive this request

Step 2: ARP Reply (Unicast)
  Device B responds: "I have IP 192.168.1.5. My MAC is
11:22:33:44:55:66"
  Only Device A receives this reply

Step 3: ARP Cache
  Device A stores the mapping in its ARP cache:
  192.168.1.5 → 11:22:33:44:55:66
  (cached for a few minutes to avoid repeated ARP requests)

ARP Commands:

Windows: arp -a          # View ARP cache
Linux:   arp -n          # View ARP cache
         ip neigh show   # Modern command

ARP Attack:

• ARP Spoofing/Poisoning — attacker sends false ARP replies to redirect traffic
• Defense: Dynamic ARP Inspection (DAI) on managed switches

IP Addressing

Types of Addressing

What is an IP Address?

An IP Address (Internet Protocol Address) is a 32-bit number (IPv4) that uniquely identifies each device on a network.

IPv4 Address Format:

Binary:  11000000.10101000.00000001.01100100
Decimal: 192.168.1.100

Format: four octets (8 bits each), separated by dots
Range per octet: 0 – 255