MAC layer¶

The Medium Access Control (MAC) layer decides how devices on the same local network share the physical medium and how they address each other. It is the lower part of the data link layer (layer 2) in the OSI model.

Where it sits¶

The IEEE 802 standards split the data link layer in two:

graph LR
  N["Network layer<br/>(IP)"] --> LLC["LLC sublayer<br/>(IEEE 802.2)"]
  LLC --> MAC["MAC sublayer"]
  MAC --> PHY["Physical layer"]

In practice, Ethernet usually skips LLC and marks the network protocol directly with the EtherType field in the MAC header.

What it does¶

MAC addresses¶

A MAC address is a 48-bit identifier (EUI-48), usually written as six hexadecimal bytes: 3c:22:fb:1a:9e:04 or 3C-22-FB-1A-9E-04.

Two bits in the first byte have special meanings:

Special addresses:

• Broadcast: ff:ff:ff:ff:ff:ff, received by every device on the local network.
• Multicast: any address with the I/G bit set, e.g. 01:00:5e:… for IPv4 multicast and 33:33:… for IPv6 multicast.

MAC addresses only matter within one local network. Routers replace the MAC header at every hop, while the IP addresses stay the same end to end.

Ethernet frame (IEEE 802.3)¶

Fields in the order they are sent:

• Minimum frame: 64 bytes from destination through FCS.
• Maximum frame: 1518 bytes, or 1522 with a VLAN tag. "Jumbo frames" of about 9000 bytes are a common non-standard extension.
• Interframe gap: at least 12 bytes of idle time between frames.

Common EtherTypes:

Worked example: Ethernet efficiency¶

Each frame costs 38 bytes on the wire beyond its payload: 8 bytes of preamble and SFD, 14 of header, 4 of FCS and 12 of interframe gap. So the best-case share of the link carrying useful data is

On a 1 Gb/s link that means at most about 975 Mb/s of payload, before IP and TCP headers take their share.

Medium access methods¶

When several devices share one medium, they need rules for who transmits when. There are three families.

Channel partitioning¶

Split the channel into fixed pieces, one per device:

• TDMA: time slots (classic GSM)
• FDMA: frequency bands
• CDMA: codes, all transmitting at once (3G)

No collisions, but capacity is wasted when a device has nothing to send.

Random access¶

Transmit when you have data, and recover from collisions.

ALOHA (1971, University of Hawaii) simply transmits and retries after a random delay. With many devices the best achievable throughput is

CSMA/CD (carrier sense multiple access with collision detection) was used by classic shared Ethernet:

1. Listen. If the medium is busy, wait until it is idle.
2. Transmit, and keep listening while transmitting.
3. If a collision is detected, stop and send a short jam signal.
4. After the \(n\)-th collision, pick a random \(K\) from \(\{0, 1, \dots, 2^{\min(n, 10)} - 1\}\) and wait \(K \times 512\) bit times (binary exponential backoff). Give up after 16 attempts.

The 64-byte minimum frame exists for CSMA/CD: a frame must last long enough (512 bit times, 51.2 µs at 10 Mb/s) for the sender to still be transmitting when a collision from the far end of the cable reaches it.

CSMA/CA (collision avoidance) is used by Wi-Fi (IEEE 802.11). A radio can't reliably hear collisions while transmitting, so Wi-Fi tries to avoid them instead:

1. Wait until the channel has been idle for a fixed time (DIFS).
2. Count down a random backoff, pausing whenever the channel becomes busy.
3. Transmit the whole frame.
4. The receiver replies with an ACK. No ACK means assume a collision, double the contention window and retry.

Optionally, a short RTS/CTS exchange (request to send / clear to send) reserves the channel first. This solves the hidden node problem: two stations that can both reach the access point but can't hear each other.

Taking turns¶

• Polling: a controller asks each device in turn (Bluetooth).
• Token passing: a token circulates and only its holder may transmit (Token Ring, IEEE 802.5; FDDI).

Switches and MAC learning¶

A switch forwards frames by MAC address using a MAC address table (also called a CAM table or forwarding database):

1. Learn: when a frame arrives, record its source address and the port it came in on.
2. Forward: if the destination address is in the table, send the frame out of that port only.
3. Flood: if the destination is unknown, or is broadcast or multicast, send it out of every port except the incoming one.
4. Age: forget entries not seen for a while (300 seconds by default).

Because flooding would loop forever in a network with redundant links, switches run the Spanning Tree Protocol (STP, IEEE 802.1D; or the faster RSTP, 802.1w) to block redundant paths.

From IP addresses to MAC addresses¶

To send an IP packet on the local network, a host must know the next hop's MAC address:

• IPv4 uses ARP: broadcast "who has 192.168.1.1?", and the owner replies with its MAC address.
• IPv6 uses Neighbor Discovery (NDP), with ICMPv6 messages sent to multicast addresses instead of a broadcast.

Results are cached in the neighbour (ARP) table.

Useful commands¶

ip link show              # interfaces and their MAC addresses
ip neigh                  # ARP / neighbour table
bridge fdb show           # MAC table of a Linux bridge
sudo tcpdump -e -i eth0   # capture frames, showing MAC headers

ifconfig en0 | grep ether   # MAC address of en0
arp -a                      # ARP table
sudo tcpdump -e -i en0      # capture frames, showing MAC headers

getmac /v                   # interfaces and their MAC addresses
arp -a                      # ARP table
Get-NetNeighbor             # neighbour table (PowerShell)

Further reading¶

• J. F. Kurose and K. W. Ross, Computer Networking: A Top-Down Approach, chapter 6 (the link layer).
• A. S. Tanenbaum and D. J. Wetherall, Computer Networks, chapter 4 (the medium access control sublayer).
• R. Perlman, Interconnections: Bridges, Routers, Switches, and Internetworking Protocols.
• IEEE 802.3 (Ethernet) and IEEE 802.11 (Wi-Fi) standards.