The Link Layer

The Link layer (OSI Layer 2: Data Link, plus Layer 1: Physical) handles the delivery of frames between two directly connected nodes — one hop at a time. It doesn't care about routing between distant networks; that's IP's job. The link layer's job is to reliably get bits across one physical medium: a copper cable, a fibre strand, or a radio channel.

The physical layer: media, duplex, encoding, and channel capacity

The Physical layer defines the physical, electrical, optical, and mechanical specifications for transmitting raw bit streams over a communication medium. It determines how 0s and 1s are converted into physical phenomena — voltage levels on copper, light pulses in glass, or radio waves through the atmosphere.

Physical transmission media comparison

Exam note: Focus on the conceptual characteristics and use cases of twisted-pair copper (UTP), coaxial, multi-mode vs. single-mode optical fibre, and radio (RF). Specific physical trivia (such as exact maximum cable lengths for legacy standards like 100BASE-TX/10BASE2 or exact fibre core micron diameters) will NOT be asked on the exam.

Duplex modes: simplex, half-duplex, and full-duplex

• Simplex: One-way communication only. One device transmits and the other only receives (e.g. keyboard to computer, broadcast radio, GPS signals).
• Half-duplex: Bidirectional communication, but only one party can transmit at a time. Devices must take turns sharing the same channel (e.g. walkie-talkies, Wi-Fi 802.11, hub-based legacy Ethernet). Simultaneous transmissions produce collisions.
• Full-duplex: Simultaneous two-way communication. Both stations can transmit and receive at the exact same instant using separate physical transmission paths (e.g. separate transmit/receive wire pairs in Cat 5e/6, dual fibre strands, or frequency-division duplexing). Full-duplex eliminates collisions entirely on point-to-point switch links.

Signalling: baseband encoding vs. broadband modulation

Digital information must be formatted into physical signals before entering the medium:

• Baseband Line Encoding Not on exam: Directly applies discrete digital voltage levels to a cable (such as NRZ or Manchester encoding, which embeds clock transitions at double the baud rate). Line encoding schemes are not tested on the exam.
• Broadband Modulation (Nice-to-know): Impresses a digital baseband bit stream onto a high-frequency continuous sinusoidal carrier wave for radio, optical, or long-distance wire transmission:
  • ASK (Amplitude Shift Keying): Modulates carrier amplitude to represent bits.
  • FSK (Frequency Shift Keying): Toggles between two discrete carrier frequencies.
  • PSK (Phase Shift Keying): Shifts the carrier phase angle (e.g. BPSK has 2 phase states; QPSK has 4 states, encoding 2 bits per symbol).
  • QAM (Quadrature Amplitude Modulation): Simultaneously modulates both amplitude and phase to pack dense bit patterns into every symbol. For example, 16-QAM encodes 4 bits/symbol, 1024-QAM (Wi-Fi 6) encodes 10 bits/symbol, and 4096-QAM (Wi-Fi 7) packs 12 bits into each symbol.

Physical-layer multiplexing (Nice-to-know): Multiple independent signals can share the same physical transmission medium simultaneously using physical-layer multiplexing:

• FDM (Frequency-Division Multiplexing): Divides the total transmission frequency spectrum into distinct, non-overlapping frequency bands, each carrying an independent communication channel (e.g. broadcast radio, cable TV, and legacy ADSL).
• TDM (Time-Division Multiplexing): Allocates periodic, recurring time slots to multiple digital channels, with each channel enjoying exclusive transmission across the entire frequency band during its assigned time slice (e.g. classic T1/E1 telephony lines and GSM).
• WDM / DWDM (Wavelength-Division Multiplexing / Dense WDM): The optical equivalent of FDM applied to optical fibres. Modulates multiple independent laser beams onto distinct optical wavelengths ("colours" of light) traveling simultaneously along a single strand of optical fibre, achieving multi-terabit per second capacities on core backbone and submarine cable networks.

Signal attenuation: As an electromagnetic signal travels through any copper cable, optical fibre, or radio airspace, its amplitude decays exponentially due to resistance, absorption, and dispersion. Attenuation is quantified in decibels: Attenuation (dB) = 10 × log10(P_in / P_out). Because high frequencies attenuate faster than low frequencies, long cable runs also distort signal waveforms, imposing strict physical length limits (such as 100 m for Ethernet over UTP) unless intermediate repeaters or regenerators are installed.

Channel capacity limits: Nyquist vs. Shannon

Two foundational mathematical theorems define the ultimate upper bound on how fast data can be pushed through any communication link:

1. Nyquist Bit Rate Theorem (Noiseless Channel, 1928)

Harry Nyquist proved that for an idealised, perfectly noise-free channel of bandwidth B (in Hertz) with M discrete signal voltage levels:

Max Capacity (C) = 2 × B × log2(M)  [bits per second]

Nyquist worked example: A noiseless voice channel with bandwidth B = 3 kHz (3,000 Hz) using binary signalling (M = 2 levels):
C = 2 × 3,000 × log2(2) = 6,000 bps = 6 kbps.
If the electronics are upgraded to support M = 16 discrete voltage levels (4 bits per symbol):
C = 2 × 3,000 × log2(16) = 2 × 3,000 × 4 = 24,000 bps = 24 kbps.

2. Shannon Capacity Theorem (Noisy Channel, Claude Shannon, 1948)

In physical reality, every communication channel is degraded by thermal noise (Gaussian white noise). Claude Shannon proved the theoretical maximum data transmission capacity C for any channel with bandwidth B and linear signal-to-noise power ratio SNR = P_signal / P_noise:

Shannon Capacity (C) = B × log2(1 + SNR)  [bits per second]

Shannon worked example: Consider a standard analogue telephone voice circuit with bandwidth B = 3 kHz (3,000 Hz) and a typical signal-to-noise ratio of 30 dB:

1. Convert SNR from decibels to linear power ratio: SNR = 10^(30 / 10) = 10^3 = 1,000.
2. Apply the Shannon formula:
   C = 3,000 × log2(1 + 1,000) = 3,000 × log2(1,001)
   Since log2(1,001) = ln(1,001) / ln(2) ≈ 6.90875 / 0.69315 ≈ 9.9672:
   C = 3,000 × 9.9672 ≈ 29,902 bps ≈ 29.9 kbps.

This physical law explains why 1990s dial-up modems peaked around 28.8–33.6 kbps on analogue local loops regardless of engineering cleverness — no modulation or coding scheme can exceed Shannon's limit for that bandwidth and noise floor.

Ethernet (IEEE 802.3)

Ethernet, invented at Xerox PARC in 1973 by Bob Metcalfe, is now defined by IEEE 802.3 and is by far the dominant wired LAN technology. Key evolutionary milestones Background — Not on exam:

• Shared bus (10BASE5, 10BASE2): all devices on one coaxial cable; one collision domain; used CSMA/CD.
• Twisted pair (10BASE-T, 1980s–90s): star topology with a hub at the centre; still one collision domain per hub.
• Switched Ethernet: switches appeared in the early 1990s, Fast Ethernet 100BASE-TX in 1995; switches replaced hubs, each port became its own collision domain, and full-duplex eliminated collisions entirely on point-to-point links.
• Gigabit/10G/25G/100G/400G: today's data centres use 25 Gbps to servers and 400 Gbps on spine switches.

MAC addresses — in detail

A MAC (Medium Access Control) address is a 48-bit (6-byte) identifier assigned to a network interface controller (NIC). Written in hexadecimal with colon or hyphen separators: 3c:22:fb:4a:1d:9e.

• OUI (bytes 0–2): Organisationally Unique Identifier, assigned by IEEE to manufacturers. 3c:22:fb = Apple. You can look up any OUI at the IEEE registry.
• NIC-specific (bytes 3–5): assigned by the manufacturer; should be globally unique for each device they ship.
• Bit 0 of byte 0 (LSB): 0 = unicast, 1 = multicast. The broadcast address FF:FF:FF:FF:FF:FF has all bits set.
• Bit 1 of byte 0: 0 = globally unique (OUI enforced), 1 = locally administered (e.g. VMs, containers, MAC randomisation on phones).

Modern OSes and phones use MAC address randomisation for privacy: a different random MAC is used for each Wi-Fi network to prevent tracking across networks.

Ethernet frame structure — complete

The minimum standard Ethernet frame size is 64 bytes excluding preamble/SFD (6 + 6 + 2 + 46 + 4). Total on-wire size including preamble+SFD: min = 8 + 64 = 72 bytes; max = 8 + 6 + 6 + 2 + 1500 + 4 = 1526 bytes (without 802.1Q tag; 1530 bytes with VLAN tag).

Error detection and correction: parity, checksums, and CRC

Physical communication media are inherently susceptible to electromagnetic interference, thermal noise, and signal attenuation, all of which can flip bits (0 ↔ 1) during transit. The link layer must detect these corrupted frames before delivering bad data to the network layer. Error detection works by appending r redundant check bits to a d-bit data payload.

1. Parity checks

• Single parity bit (1D parity): Appends 1 bit so that the total count of 1s in the frame is always even (even parity) or odd (odd parity). Detects any odd number of bit errors (1, 3, 5...). However, if an even number of bits flip (e.g. a 2-bit burst error), the parity remains unchanged and the corruption goes completely undetected.
• Two-dimensional parity (2D parity): Organises data bits into an i × j matrix. Parity is calculated for each row and each column. If a single bit flips, both its corresponding row and column parity checks fail, identifying the exact coordinate of the corrupted bit. 2D parity can thus perform Forward Error Correction (FEC) on single-bit errors without retransmission, and detect any 2-bit error.

Worked 2D Even-Parity Example (Single-Bit Error Correction):

Original transmitted matrix:          Received matrix (1 bit flipped!):
Data bits    | Row Parity             Data bits    | Row Parity
1  0  1  0   |     0                  1  0  1  0   |     0   (OK)
1  1  0  0   |     0                  1  0* 0  0   |     0   <-- Row 2 parity FAILS (odd 1s!)
0  1  1  0   |     0                  0  1  1  0   |     0   (OK)
0  0  1  1   |     0                  0  0  1  1   |     0   (OK)
─────────────┼──────                  ─────────────┼──────
0  0  1  1   |     0  <- Col Parity   0  0  1  1   |     0
                                         ^
                                   Col 2 parity FAILS!

Intersection of failed Row 2 and failed Column 2 pinpoints bit (Row 2, Col 2).
The receiver flips that bit back from 0 to 1 without requesting a retransmission!

2. Internet checksum — with worked example

Used primarily at the network and transport layers (IPv4 headers, TCP segments, UDP datagrams), the Internet Checksum groups bytes into 16-bit words, adds them using one's complement arithmetic with end-around carry, and inverts the final sum.

Worked Internet Checksum calculation:
Suppose a sender transmits three 16-bit words:
Word 1 : 0x4500  (binary: 0100 0101 0000 0000)
Word 2 : 0x0073  (binary: 0000 0000 0111 0011)
Word 3 : 0xF002  (binary: 1111 0000 0000 0010)

Step 1: Sum the 16-bit words:
    0x4500 + 0x0073 = 0x4573
    0x4573 + 0xF002 = 0x13575   (17 bits — a carry bit 1 overflowed bit 15!)

Step 2: Add the end-around carry back into the least significant bit:
    0x3575 + 0x0001 = 0x3576    (binary: 0011 0101 0111 0110)

Step 3: Take the one's complement (invert all bits) to produce the checksum:
    ~0x3576 = 0xCA89            (binary: 1100 1010 1000 1001)

Transmitted data: Word 1, Word 2, Word 3, plus Checksum (0xCA89).

Receiver verification:
Receiver sums all incoming words including the checksum:
    0x4500 + 0x0073 + 0xF002 = 0x13575  → wrap carry: 0x3576
    0x3576 + 0xCA89 (checksum) = 0xFFFF (all 1s)
Inverting 0xFFFF yields 0x0000 (zero). If the result is all zeros, the data is verified intact!

The checksum is computationally lightweight to implement in software on generic microprocessors, but it is structurally weaker than CRC: it cannot detect transposed words (swapping word orders leaves the sum unchanged) and can miss even-bit errors where one word increases by the exact amount another decreases.

3. Cyclic Redundancy Check (CRC) — worked example

CRC (polynomial codes) is the gold standard for link-layer hardware error detection, used in Ethernet's 4-byte Frame Check Sequence (FCS) and 802.11 Wi-Fi. It operates using modulo-2 arithmetic, where addition and subtraction are equivalent to bitwise XOR with no carries or borrows.

Both sender and receiver agree on an (r + 1)-bit generator polynomial G. The degree of G is r, which yields an r-bit remainder (FCS) R:

1. Sender appends r zeros to the data bits D, producing D × 2^r.
2. Sender divides D × 2^r by G using modulo-2 long division (XOR). The remainder is R.
3. Sender transmits the composite frame: T = [D | R].
4. Receiver divides the incoming bits T by G. If the remainder is exactly zero, the frame is accepted; otherwise, it is silently discarded.

Worked CRC calculation:
Data bits (D)      : 101110
Generator (G)      : 1001   (degree r = 3, so append 3 zeros)
Data with zeros    : 101110000

Step-by-step XOR division (shifting generator under each leading 1):
  101110000   (initial data with 3 appended zeros)
⊕ 1001
─────────
  001010000   (step 1: shift G to align under leading 1)
  ⊕ 1001
  ─────────
    000011000 (step 2: shift G to align under leading 1)
    ⊕   1001
    ─────────
        0001010 (step 3: shift G to align under leading 1)
        ⊕  1001
        ───────
        0000011 Remainder (R) = 011

Transmitted frame (D + R): 101110011
Receiver verification: 101110011 / 1001 leaves Remainder 000 (valid frame!)

Standard CRC-32 (IEEE 802.3) uses a 32-bit generator polynomial (0x04C11DB7), guaranteeing detection of all single- and double-bit errors, all odd numbers of inverted bits, and any burst error up to 32 consecutive bits long.

4. Hamming codes and error correction

Invented by Richard Hamming in 1950, Hamming codes are linear block error-correcting codes that interleave parity check bits at positions corresponding to powers of two (bits 1, 2, 4, 8, 16...). Each parity bit calculates even parity over a unique combination of data bit positions.

Hamming codes are governed by the concept of Hamming distance (d_min, the minimum number of bit positions in which any two valid codewords differ):

• To detect t bit errors, the code must satisfy d_min ≥ t + 1.
• To correct t bit errors, the code must satisfy d_min ≥ 2t + 1.

For example, the classic Hamming(7,4) code encodes 4 data bits into a 7-bit codeword by adding 3 parity bits. Because it has a minimum Hamming distance of d_min = 3, it can detect up to 2-bit errors and perform Single Error Correction (SEC) on any 1-bit error without retransmission. Appending one extra parity bit yields SEC-DED (Single Error Correction, Double Error Detection), the standard algorithm implemented in computer ECC memory.

Comparison of error detection and correction techniques

Multiple access protocols: ALOHA and CSMA

When multiple stations share a broadcast communication channel (such as satellite links, radio spectrum, or early coaxial bus cables), their transmitted signals interfere if they overlap in time. Medium Access Control (MAC) protocols coordinate how nodes share the channel.

Taxonomy of Medium Access Control (MAC) protocols

Computer scientists categorize MAC protocols into three major architectural families:

1. Pure ALOHA (Abramson, 1970)

Developed at the University of Hawaii for island radio communications. Pure ALOHA is unslotted and completely uncoordinated: whenever a station has a frame, it transmits immediately.

A frame of transmission time T collides if any other station begins transmitting anywhere within the interval [t0 − T, t0 + T]. The vulnerable period is 2T. Under a Poisson traffic distribution with offered load G (frames generated per frame-time T), channel throughput S is given by:

S = G × e^(−2G)

Differentiating with respect to G yields the maximum possible throughput at G = 0.5:

Pure ALOHA calculation at G = 0.5 (offered traffic load):
S = G × e^(−2G)
S = 0.5 × e^(−2 × 0.5)
S = 0.5 × e^(−1) = 0.5 × 0.36788 ≈ 0.1839  →  18.4% throughput

2. Slotted ALOHA (Roberts, 1972)

Slotted ALOHA divides time into uniform discrete slots equal to frame duration T, synchronised by a central clock. Stations may only begin transmitting at the precise boundary of a time slot. This halves the vulnerable period to exactly 1T (only frames arriving during the immediately preceding slot collide).

Throughput is given by S = G × e^(−G). Maximum throughput occurs at G = 1.0:

S_max = 1.0 × e^(−1) = 1/e ≈ 0.368 (36.8% — exactly double pure ALOHA).

3. CSMA — Carrier Sense Multiple Access

ALOHA transmitted blindly without checking if the medium was currently occupied. CSMA introduces a sensible rule: carrier sensing ("listen before talk"). A station listens to the medium; if another station is transmitting, it defers.

Why collisions still happen in CSMA: Radio and electrical signals travel at the finite speed of light (≈ 200,000 km/s in cable). If Station A starts transmitting at t = 0, the signal takes propagation delay τ to reach distant Station B. If B senses the medium at t = τ − 1 μs, the wire appears completely silent! B transmits, and the two wavefronts collide midway down the cable.

CSMA/CD — why it mattered (historical)

CSMA/CD (Carrier Sense Multiple Access with Collision Detection) was used on half-duplex shared Ethernet. Each device: (1) listens before transmitting (Carrier Sense), (2) transmits while monitoring for collisions (Multiple Access), (3) if it detects a collision, immediately aborts transmission, sends a 48-bit jam signal to ensure all stations detect the collision, and executes truncated binary exponential backoff: after the k-th collision, it chooses an integer K uniformly at random from {0 .. 2^k − 1} where k = min(attempt, 10), and waits K × 51.2 μs (512 bit times at 10 Mbps, representing the slot time). After 16 consecutive collisions, the frame is aborted. Modern full-duplex switched Ethernet has zero collision domains and CSMA/CD is disabled.

Transmission Time (L_min / R) ≥ Round-Trip Propagation Time (2 × τ_prop)
Rearranging:
L_min = 2 × τ_prop × R

Switches — how they work internally

To understand modern Ethernet switches, it helps to trace their lineage from earlier network devices: hubs and bridges.

Hubs, bridges, and switches comparison Nice-to-know

An Ethernet switch maintains a MAC address table (also called CAM table — Content Addressable Memory). For each port, it stores the MAC addresses of devices reachable through that port, plus an age timer.

Learning, forwarding, flooding, filtering:

1. Learning: when a frame arrives on port 3 from source MAC AA:BB:CC:DD:EE:01, the switch records AA:BB:CC:DD:EE:01 → port 3 in its CAM table.
2. Forwarding: if the destination MAC is in the CAM table, the frame is sent only to the listed port.
3. Flooding: if the destination MAC is NOT in the table (unknown unicast), the switch sends the frame to all ports except the incoming one. The target responds, revealing its port, and the switch learns it.
4. Filtering: if source and destination are on the same port (same collision domain), the frame is discarded.
5. Aging: entries that haven't been refreshed in 300 seconds (default) are removed, accommodating devices that move between ports.

Worked trace: Switch MAC table learning step-by-step

Suppose a switch boots up with an empty CAM table. Four hosts are connected: Host A on Port 1 (MAC_A), Host B on Port 2 (MAC_B), Host C on Port 3 (MAC_C), and Host D on Port 4 (MAC_D):

# Show a switch's MAC address table (Cisco IOS example)
Switch# show mac address-table
Vlan  Mac Address         Type     Ports
----  -----------------   -------  ------
   1  3c:22:fb:4a:1d:9e   DYNAMIC  Gi0/1
   1  a4:83:e7:12:34:56   DYNAMIC  Gi0/2
  10  bc:67:45:ab:cd:ef   DYNAMIC  Gi0/5   ← VLAN 10

ARP — Address Resolution Protocol (RFC 826)

IPv4 addresses are 32-bit logical addresses. Ethernet needs 48-bit MAC addresses. ARP bridges this gap for the local subnet.

ARP packet format

Step-by-step ARP resolution (host A at 192.168.1.10 wants to reach 192.168.1.20):

1. A checks its ARP cache: no entry for 192.168.1.20.
2. A broadcasts an ARP request: Ethernet dst = FF:FF:FF:FF:FF:FF, "Who has 192.168.1.20? Tell 192.168.1.10."
3. All hosts on the subnet receive the broadcast. The host with 192.168.1.20 replies directly (unicast) to A's MAC: "192.168.1.20 is at AA:BB:CC:00:00:20."
4. A adds the mapping to its ARP cache (entries typically expire after tens of seconds on Linux/Windows — e.g. reachable state lasts ~15–45 s on Linux before transitioning to STALE, and Windows expires inactive entries in tens of seconds — while network devices like Cisco IOS default to 4 hours).
5. A wraps the IP packet in an Ethernet frame with dst MAC = AA:BB:CC:00:00:20 and sends it.

Proxy ARP: a router can respond to ARP requests on behalf of hosts on another subnet, making those hosts appear directly reachable. Used in some VPN configurations.

Gratuitous ARP: a host ARPs for its own IP address. Used at boot to detect IP conflicts (if anyone replies, there's a conflict), and after failover to announce a new MAC for an IP.

Viewing and managing the ARP cache

# Linux
$ ip neigh show
192.168.1.1 dev eth0 lladdr aa:bb:cc:dd:ee:ff REACHABLE
192.168.1.5 dev eth0 lladdr 11:22:33:44:55:66 STALE

# macOS / BSD
$ arp -a
? (192.168.1.1) at aa:bb:cc:dd:ee:ff on en0 [ethernet]

# Windows
> arp -a

VLANs — more detail

A VLAN (Virtual LAN, IEEE 802.1Q) segments one physical switch into multiple logical switches, each with its own broadcast domain. Key concepts:

• VLAN ID (VID): 12-bit field in the 802.1Q tag; values 1–4094 (0 and 4095 reserved). Allows up to 4094 VLANs per switch.
• Access port: connects an end device (PC, server). Frames arriving untagged are assigned to the port's VLAN. Frames leaving are untagged (device is unaware of VLANs).
• Trunk port: connects switch-to-switch or switch-to-router. Carries frames from multiple VLANs; each frame is 802.1Q-tagged so the other end knows which VLAN it belongs to. The "native VLAN" on a trunk carries untagged frames (default VLAN 1 — often changed for security).
• Inter-VLAN routing: VLANs can't communicate at layer 2. Options: a router with sub-interfaces (router-on-a-stick), or a layer-3 switch with an SVI (Switched Virtual Interface) per VLAN.

Life of a VLAN-tagged frame across a trunk link:

1. PC1 → Switch 1 (Access Port 1, VLAN 10):
   PC1 sends a standard untagged Ethernet frame (end devices do not know VLANs exist).

2. Switch 1 → Switch 2 (Trunk Port):
   Switch 1 inserts a 4-byte IEEE 802.1Q tag (TPID = 0x8100, VID = 10) directly after
   the Source MAC address, recalculates the 32-bit FCS trailer, and transmits across the trunk cable.

3. Switch 2 → PC2 (Access Port 2, VLAN 10):
   Switch 2 inspects VID = 10, strips the 4-byte 802.1Q tag, recalculates the FCS, and
   delivers a standard untagged Ethernet frame out Access Port 2 to PC2.
   (Ports assigned to VLAN 20 never receive traffic or broadcasts from VLAN 10).

STP — Spanning Tree Protocol (briefly) Beyond

Loops in a switched network cause broadcast storms: a broadcast frame is forwarded indefinitely, consuming all bandwidth. STP (IEEE 802.1D) detects loops and blocks redundant ports, creating a loop-free logical tree. When an active link fails, STP unblocks a redundant path (convergence takes 30–50 seconds with classic STP; RSTP/802.1w converges typically about a second or a few seconds). Understanding STP is important for diagnosing unexpected port blocking.

Wireless LANs (IEEE 802.11), CSMA/CA, and RTS/CTS

While Ethernet dominates wired local area networks, IEEE 802.11 (Wi-Fi) is the standard for wireless local area networks (WLANs). Operating over radio frequency bands (2.4 GHz, 5 GHz, and 6 GHz), wireless presents unique physical and link-layer challenges: radio signals attenuate rapidly with distance, reflect off surfaces causing multipath interference, and share a completely broadcast, unshielded medium.

WLAN architecture and key standards

• BSS (Basic Service Set): The fundamental building block of an 802.11 network. In infrastructure mode, a BSS consists of an Access Point (AP) and associated client stations (STAs). The BSS is identified by a 48-bit MAC address called the BSSID (the AP's radio MAC).
• ESS (Extended Service Set): Multiple BSS access points interconnected via a wired backbone (Distribution System) sharing a single human-readable network name, the SSID (Service Set Identifier). Clients roam seamlessly between APs within the same ESS.
• Ad-hoc mode (IBSS): Stations communicate directly peer-to-peer without any central AP.

Why CSMA/CD cannot work in wireless networks

Ethernet used CSMA/CD (Carrier Sense Multiple Access with Collision Detection). Wireless cannot use collision detection for two fundamental physical reasons:

1. Extreme signal attenuation (dynamic range): A station's own radio transmitter outputs orders of magnitude more power (e.g. 100 mW) than the faint signal received from another station tens of metres away (often picowatts, −70 to −90 dBm). The station's own transmission deafens its receiver; detecting a colliding signal while transmitting is practically impossible without prohibitively expensive full-duplex hardware.
2. Spatial mismatch (hidden nodes): In wired Ethernet, a collision is felt everywhere on the shared copper wire. In wireless, what matters is whether a collision occurs at the receiver's antenna, which the transmitter cannot determine simply by sensing its own local airspace.

Consequently, 802.11 uses CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance).

CSMA/CA mechanism: IFS, contention window, and explicit ACKs

CSMA/CA avoids collisions before they happen by pacing transmissions with precision timers:

• SIFS (Short Inter-Frame Space): The shortest gap (typically 10–16 µs). Given highest priority; used for immediate control responses like ACK, CTS, and polling replies. No station can transmit new data during SIFS.
• DIFS (Distributed Coordination Function IFS): Defined as DIFS = SIFS + 2 × SlotTime (typically 28–50 μs depending on physical-layer standard). If the medium has been idle for ≥ DIFS, a station may send its first frame immediately without backoff.
• Contention Window (CW) & Random Backoff: If the medium is sensed busy, or immediately following any transmission, stations must wait a random backoff time: Backoff time = Random(0, CW) × SlotTime. The backoff counter decrements only while the channel remains idle. If another transmission is detected, the counter freezes and resumes only after the channel has been idle for DIFS again.
• Exponential backoff: The contention window starts at CW_min (e.g., 15 slots). If a transmission fails, the station doubles the window: CW = 2 × (CW + 1) − 1, up to CW_max (typically 1023 slots).
• Mandatory explicit ACKs: Because a transmitting station cannot detect whether its frame collided during transit, every unicast frame requires an immediate link-layer ACK from the receiver. If the sender does not receive an ACK within an ACK timeout, it assumes a collision occurred, increases CW, and retransmits.

The hidden terminal problem and RTS/CTS

Consider three stations: Station A and Station C are located on opposite sides of Access Point B. Station A can communicate with B, and Station C can communicate with B. However, A and C are separated by distance or a wall and cannot hear each other's radio transmissions.

When Station A wishes to send to B, it senses the channel idle. Simultaneously, Station C wishes to send to B and senses the channel idle (because C cannot hear A). Both transmit simultaneously; their transmissions collide at B. Neither A nor C knows the collision occurred until their ACK timers expire.

The solution: Virtual Carrier Sensing via RTS/CTS

1. RTS (Request to Send): Station A transmits a short control frame (20 bytes) to B containing a Duration field specifying the exact microsecond duration needed to transmit the data frame, SIFS gaps, and the ACK.
2. CTS (Clear to Send): AP B responds with a unicast CTS frame (14 bytes) addressed directly to Station A after SIFS, echoing the requested duration.
3. Setting the NAV: Although the CTS is addressed to Station A, wireless is a shared medium, so Station C overhears B's CTS frame! Station C recognises it is not the recipient, extracts the Duration value, and sets its internal NAV (Network Allocation Vector) countdown timer. The NAV acts as a virtual carrier sense: C treats the medium as busy and refuses to transmit until the NAV timer hits zero, even though its physical receiver detects no energy on the frequency.
4. Station A sends its data frame unimpeded and receives an ACK from B.

RTS Threshold: Because the RTS/CTS exchange introduces protocol overhead, transmitting RTS/CTS for small frames wastes more time than a collision would cost. Modern Wi-Fi drivers implement an RTS Threshold (typically 2,347 bytes): packets smaller than the threshold skip RTS/CTS, while larger packets use it to guarantee clear airtime.

WLAN association flow: connecting to an Access Point

Before an 802.11 station (such as your smartphone or laptop) can send or receive data through a wireless network, it must complete a three-stage discovery and handshake sequence:

1. Scanning (Discovery):
   • Passive scanning: The client listens across radio channels for periodic Beacon frames broadcast by APs (typically transmitted every 100 ms). Beacons announce the network's SSID, supported data rates, encryption capabilities, and BSSID.
   • Active scanning: To speed up discovery, the client broadcasts a Probe Request frame on each channel. Nearby APs immediately reply with a Probe Response frame containing their configuration details.
2. 802.11 Authentication: The client sends an Authentication Request frame to the selected AP, and the AP responds with an Authentication Response. In modern networks, this step uses "Open System Authentication" (a formal link-layer handshake); actual cryptographic authentication occurs during subsequent WPA handshakes.
3. Association: The client transmits an Association Request frame specifying its supported capabilities, listen interval, and preferred cipher suites. The AP allocates buffer resources, registers the client in its association table, and responds with an Association Response frame assigning an Association ID (AID). Only after association can data frames flow.

The 802.11 MAC frame format and the four address fields

Unlike Ethernet frames (which contain exactly two MAC addresses: source and destination), an 802.11 MAC frame contains up to four MAC address fields. Because wireless stations communicate through an intermediate Access Point that bridges onto a wired backbone (Distribution System / DS), frames must distinguish between the transmitting/receiving radio interfaces and the original source/ultimate destination hosts.

The interpretation of Address fields 1 through 4 is governed by two 1-bit flags in the 802.11 Frame Control header: To DS and From DS:

Power management in 802.11

Transmitting and receiving over Wi-Fi drains substantial mobile battery power. 802.11 stations can declare a low-power sleep/doze state by setting the Power Management bit in their MAC frame headers. While a station sleeps, the Access Point buffers all incoming frames addressed to it. In each periodic Beacon frame, the AP broadcasts a Traffic Indication Map (TIM) bitmap; sleeping stations wake their radios briefly to inspect the TIM. If pending frames are flagged, the station sends a PS-Poll (Power Save Poll) frame to retrieve the buffered data before returning to sleep.

Wi-Fi security evolution: WEP to WPA3

• WEP (Wired Equivalent Privacy, 1999): The original 802.11 security scheme, using the RC4 stream cipher with static 24-bit Initialisation Vectors (IVs). Catastrophically broken due to rapid IV reuse and weak CRC-32 integrity; modern cracking tools can recover WEP keys within minutes by collecting a few thousand frames.
• WPA (Wi-Fi Protected Access, 2003): An interim standard designed to run on existing WEP hardware. Replaced static keys with TKIP (Temporal Key Integrity Protocol), which mixed a per-packet key, but TKIP was also later compromised.
• WPA2 (IEEE 802.11i, 2004): Mandated the robust AES-CCMP cipher suite. While cryptographically sound, WPA2-Personal (PSK) relies on a 4-way handshake that is vulnerable to offline dictionary cracking if an attacker captures the initial handshake and the user chose a weak passphrase.
• WPA3 (2018): Modern security standard. Replaces PSK with SAE (Simultaneous Authentication of Equals) based on Dragonfly key exchange. SAE provides forward secrecy and completely protects against offline dictionary attacks even with simple passwords. Enforces Protected Management Frames (PMF) to prevent forged deauthentication attacks.
• WPA2/WPA3-Enterprise: Eliminates pre-shared passwords by integrating IEEE 802.1X / EAP (Extensible Authentication Protocol) with a central RADIUS or Diameter authentication server. Each user authenticates with individual credentials or certificates, receiving unique dynamic per-session encryption keys.

MTU, fragmentation, and PMTUD

The Ethernet MTU of 1500 bytes is the maximum IP packet size that can traverse one Ethernet hop without fragmentation. A path from your laptop to a server may cross dozens of links; if any link has a smaller MTU, fragmentation is required (for IPv4) or the sender must reduce its packet size (for IPv6, which forbids router fragmentation).

Path MTU Discovery (PMTUD, RFC 1191 for IPv4, RFC 8201 for IPv6): the sender sets the IPv4 "Don't Fragment" (DF) bit. If a router encounters a packet too large for the next link, it sends back an ICMP "Fragmentation Needed" message with the next-hop MTU. The sender reduces its MSS accordingly. PMTUD can fail if firewalls block ICMP — this causes "black holes" where large packets are silently dropped. The fix: MSS clamping (firewalls or routers rewrite the TCP MSS option to a safe value).