Physical And Data Link Layers
MAC Addressing and Ethernet
The first three bytes are the ORGANISATIONALLY
JrCodex·8 min read
Jr Codex Computer Networks Notes
Level: Beginner–Intermediate Prerequisites: Chapter 2: Framing and Error Detection Time to complete: ~20 minutes
Table of Contents
- MAC Addresses
- The Ethernet Frame
- The Shared Medium Problem
- CSMA/CD
- How Switching Removed the Problem
- Wifi and CSMA/CA
- Summary & Next Steps
1. MAC Addresses
The Format
─────────────────────────────────────────
48 bits, written as six hex bytes:
00:1A:2B:3C:4D:5E
└────────┘ └──────┘
OUI device-specific
(vendor) (assigned by vendor)
The first three bytes are the ORGANISATIONALLY
UNIQUE IDENTIFIER, assigned to a manufacturer.
You can look up a MAC's vendor from it.
─────────────────────────────────────────
Two Bits Worth Knowing
─────────────────────────────────────────
In the first byte:
BIT 0 (least significant)
0 = UNICAST — one device
1 = MULTICAST — a group
BIT 1
0 = globally unique (burned in by the vendor)
1 = locally administered (software-assigned)
Broadcast is the special address
FF:FF:FF:FF:FF:FF — every device on the link.
─────────────────────────────────────────
MAC vs IP — the Distinction That Matters
─────────────────────────────────────────
MAC FLAT and PERMANENT. Burned into the
hardware. Says nothing about location.
Scope: THIS LINK ONLY.
IP HIERARCHICAL and ASSIGNED. Changes when
you move networks. Encodes WHERE you are.
Scope: GLOBAL.
WHY BOTH: a router forwards by IP because IP's
hierarchy makes routing tables small enough to be
possible. But to actually hand a frame to the
next device, it needs that device's MAC.
So every hop REWRITES the MAC addresses while the
IP addresses stay the same, end to end.
Chapter 4 shows this happening.
─────────────────────────────────────────
Why Routing on MAC Would Be Impossible
─────────────────────────────────────────
MAC addresses have no structure. To route on
them, every router would need an entry for EVERY
DEVICE ON EARTH — billions of rows, with no way
to summarise.
IP addresses are hierarchical, so one routing
entry can cover millions of addresses
(Module 3, Chapter 1). That is the entire reason
the internet scales.
─────────────────────────────────────────
2. The Ethernet Frame
The Layout
─────────────────────────────────────────
┌──────────┬─────┬─────┬─────┬──────┬─────────────┬─────┐
│ PREAMBLE │ SFD │ DST │ SRC │ TYPE │ PAYLOAD │ FCS │
│ 7 bytes │ 1 │ 6 │ 6 │ 2 │ 46 - 1500 │ 4 │
└──────────┴─────┴─────┴─────┴──────┴─────────────┴─────┘
PREAMBLE 10101010 × 7 — lets the receiver's
clock lock on (Chapter 1)
SFD start frame delimiter, 10101011
DST/SRC MAC addresses
TYPE EtherType — the demux field
(Module 1, Chapter 3)
0x0800 IPv4 · 0x86DD IPv6 · 0x0806 ARP
PAYLOAD the IP packet
FCS CRC-32 (Chapter 2)
─────────────────────────────────────────
The 46-Byte Minimum
─────────────────────────────────────────
A frame shorter than 46 bytes of payload is
PADDED.
WHY: collision detection (Section 4) requires a
frame to still be transmitting when a collision
from the far end reaches back. Too short, and the
sender finishes before it could notice.
A relic of shared-medium Ethernet that remains in
the standard, and a good example of a physical
constraint becoming a permanent format rule.
─────────────────────────────────────────
The 1500-Byte Maximum
─────────────────────────────────────────
This is the MTU from Module 1, Chapter 3.
Larger frames would be more efficient — less
header overhead per byte — but a corrupted frame
wastes more, and one sender would hold the medium
longer.
JUMBO FRAMES (9000 bytes) exist for datacentres,
where loss is rare and efficiency matters. They
must be enabled on EVERY device in the path, or
you get the silent large-packet failure from
Module 1, Chapter 3.
─────────────────────────────────────────
3. The Shared Medium Problem
Original Ethernet
─────────────────────────────────────────
One coaxial cable. Every machine attached to it.
A bus topology (Module 1, Chapter 4).
A────B────C────D
═══════════════════ one shared cable
Everyone hears everything. Only ONE may transmit
at a time.
If two transmit simultaneously, their signals
overlap and both are destroyed. A COLLISION.
─────────────────────────────────────────
The Coordination Problem
─────────────────────────────────────────
No central authority decides who transmits.
It is the dinner-party problem: several people,
one conversation, nobody in charge. Humans solve
it by listening for a pause and backing off when
two people start together.
CSMA/CD is exactly that, formalised.
─────────────────────────────────────────
4. CSMA/CD
Carrier Sense Multiple Access with Collision Detection
─────────────────────────────────────────
1. CARRIER SENSE
Listen. Is the medium busy? Wait if so.
2. TRANSMIT
Start sending, and KEEP LISTENING.
3. COLLISION DETECTION
Does the signal on the wire differ from what
I am sending? Then someone else is
transmitting too.
4. JAM
Send a jam signal so EVERY station notices the
collision.
5. BACK OFF
Wait a random time, then retry from step 1.
─────────────────────────────────────────
import random
def backoff_slots(attempt, max_attempts=16):
"""Binary exponential backoff — the mechanism that makes CSMA/CD stable."""
if attempt > max_attempts:
raise Exception("excessive collisions — give up")
k = min(attempt, 10) # the range stops growing after 10
return random.randint(0, 2**k - 1) # slots of 51.2 µs each
for attempt in range(1, 6):
print(f"attempt {attempt}: wait 0..{2**min(attempt,10)-1} slots")
# attempt 1: wait 0..1 ← small range: likely to collide again
# attempt 2: wait 0..3
# attempt 3: wait 0..7
# attempt 4: wait 0..15 ← range doubles each time
# attempt 5: wait 0..31Why the Range Doubles
─────────────────────────────────────────
A collision means too many stations wanted the
medium at once.
Doubling the random range spreads retries over a
wider window, so the probability of colliding
again falls. The protocol ADAPTS to load without
measuring it.
The same idea appears in TCP's congestion control
(Module 4, Chapter 4) and in every retry-with-
backoff loop you have written.
─────────────────────────────────────────
5. How Switching Removed the Problem
The Change
─────────────────────────────────────────
HUB (a layer 1 device)
Repeats every incoming signal to every port.
All ports are ONE collision domain.
Bandwidth is SHARED. Half duplex. Collisions.
SWITCH (a layer 2 device)
Reads the destination MAC and forwards only to
the correct port (Chapter 4).
EACH PORT is its own collision domain.
Full bandwidth PER PORT. Full duplex.
NO COLLISIONS AT ALL.
─────────────────────────────────────────
The Consequence
─────────────────────────────────────────
On a modern switched network, CSMA/CD is DISABLED
and never runs.
A device transmits whenever it likes, because it
has a dedicated full-duplex link to the switch.
Nothing can collide with it.
So why learn CSMA/CD?
- it explains the 46-byte minimum frame size,
which is still in every frame you send
- the backoff algorithm recurs throughout
networking
- wifi still needs the shared-medium logic
(Section 6)
- and it is asked in interviews constantly
─────────────────────────────────────────
6. Wifi and CSMA/CA
Why Wifi Cannot Use CSMA/CD
─────────────────────────────────────────
Collision DETECTION requires listening while
transmitting.
A radio transmitting at full power cannot hear a
distant station's much weaker signal — its own
transmission drowns everything. Detection is
physically impossible.
THE HIDDEN TERMINAL PROBLEM makes it worse:
A ····· AP ····· C
A and C can both reach the access point, but
NOT each other. Each senses an idle medium and
transmits. They collide AT THE AP, and neither
ever knows.
─────────────────────────────────────────
CSMA/CA — Collision AVOIDANCE
─────────────────────────────────────────
1. Sense the medium. If busy, wait.
2. If idle, wait a random backoff period FIRST,
BEFORE transmitting — rather than after a
collision.
3. Transmit.
4. Wait for an explicit ACK. No ACK means the
frame was lost; retry.
OPTIONAL RTS/CTS, for the hidden terminal:
A sends Request To Send to the AP.
The AP replies Clear To Send — which C HEARS,
so C stays quiet.
A transmits without interference.
─────────────────────────────────────────
The Costs, and What They Explain
─────────────────────────────────────────
Backoff BEFORE every transmission, an ACK for
every frame, and RTS/CTS overhead where enabled.
This is a large part of why real wifi throughput
is far below its advertised rate (Chapter 1) —
the protocol overhead is inherent, not a
configuration problem.
It also explains why wifi degrades sharply as you
add devices: they all contend for the same
medium, and contention rises faster than
linearly.
─────────────────────────────────────────
7. Summary & Next Steps
Key Takeaways
- MAC addresses are flat, permanent and link-scoped; IP addresses are hierarchical and global, and routing on MAC would require an entry per device on earth.
- Ethernet's 46-byte minimum payload exists so a sender is still transmitting when a collision could reach it — a physical constraint frozen into the frame format.
- Switching gave each port its own collision domain and full duplex, which eliminated collisions entirely and made CSMA/CD dormant on modern LANs.
- Wifi cannot detect collisions because a transmitting radio cannot hear, so it avoids them instead — with backoff before sending and an ACK per frame, which is inherent overhead.
Concept Check
- Why does every hop rewrite the MAC addresses while the IP addresses stay unchanged?
- What would happen to Ethernet's minimum frame size requirement if collision detection had never existed?
- Explain the hidden terminal problem and how RTS/CTS addresses it.
Next Chapter
→ Chapter 4: Switching, ARP and VLANs
Jr Codex — 1-on-1 Personalized Coaching | Back to Module Index | Back to Computer Networks Index