Ethernet, MAC addresses, switches and ARP

On the previous page you saw who gets to talk on a shared channel. Today almost all wired LANs are Ethernet, and in modern Ethernet the hosts are connected one by one to a switch. This page covers the “address” side of the link layer: MAC addresses, how a switch learns, and how to get from an IP address to a MAC address (ARP). You will come back to this page many times in the security half of the course, because the protocols at this layer do no authentication.

Golden rules:

1. An Ethernet frame is 64 to 1518 bytes (excluding the preamble). The payload is at least 46 bytes; if shorter, it is padded.
2. A switch learns the source address and forwards by the destination address.
3. An ARP request is broadcast, the reply is unicast.
4. The IP address stays the same end to end, the MAC address changes on every link.

The Ethernet frame

+----------+---------+---------+------+--------------+-----+
| Preamble | Dst MAC | Src MAC | Type |   Payload    | FCS |
|  8 byte  | 6 byte  | 6 byte  | 2 B  | 46-1500 byte | 4 B |
+----------+---------+---------+------+--------------+-----+

Ethernet is connectionless and unreliable: no handshake, no ACK. A frame that fails the CRC is discarded; noticing the loss is the job of the upper layer (TCP).

Sizes and padding

Minimum: $6 + 6 + 2 + 46 + 4 = 64$ bytes. This limit comes from the CSMA/CD minimum frame rule on the previous page (512 bits). For a 20-byte datagram, $46 - 20 = 26$ bytes of padding are added.

Maximum: $6 + 6 + 2 + 1500 + 4 = 1518$ bytes.

Efficiency

On the wire, every frame is preceded by an 8-byte preamble and followed by a 12-byte inter-frame gap.

Max payload (1500) : 1500 / (1518 + 8 + 12) = 1500 / 1538 = 97.53%
Min payload (46)   : 46 / (64 + 8 + 12)     = 46 / 84     = 54.76%
1518 B @100 Mbps   : 12,144 bit / 10^8      = 121.44 us

MAC addresses

A MAC (LAN, physical) address is 48 bits and is written in hexadecimal: 3C:22:FB:10:A4:7E. It is written into the network card (NIC) at manufacture, but it can be changed in software (this is a security issue).

first byte  binary      I/G  U/L  type
0x00        00000000    0    0    unicast, global
0x01        00000001    1    0    multicast (01:00:5E -> IPv4 multicast)
0x3A        00111010    0    1    unicast, locally assigned (random MAC)
0xFF        11111111    1    1    FF:FF:FF:FF:FF:FF = broadcast

MAC versus IP. A MAC address is a flat identity like a social security number and carries no location information; it stays the same whichever network the laptop joins. An IP address is hierarchical like a postal address and changes with the network you connect to. Routing is done with IP, and delivery on the last link with MAC.

TIP · random MAC. Phones connect to each Wi-Fi network with a different, locally assigned (U/L = 1) MAC. The goal is to make it harder to track a user across networks by MAC: a privacy measure.

Switch: the self-learning bridge

A hub is a physical-layer device that just copies bits to all ports; everyone connected stays in one collision domain. A switch is a link-layer device: it reads the frame and sends it only to the port that needs it. Hosts are unaware that the switch exists (transparent).

A switch has a forwarding table (CAM): MAC → port, time. Nobody fills the table by hand; the switch learns it itself (self-learning):

1. A frame arrived from port $x$. Write the source MAC into the table as “port $x$” (or refresh its timer).
2. Look up the destination MAC in the table:
   • If it is not there: send the frame to all ports except the one it arrived on (flooding).
   • If it is there and the port is $x$: discard (filtering), the destination is already on the same segment.
   • If it is there and the port is another port $y$: forward only to $y$ (forwarding).
3. Entries are deleted if unused for a certain time (aging time, typically 300 s).

Worked example: a learning trace

Frame (source -> destination, in port)   Decision     Table after
A -> B, port 1                           flood        A=1
B -> A, port 2                           port 1       A=1 B=2
C -> A, port 3                           port 1       A=1 B=2 C=3
A -> C, port 1                           port 3       A=1 B=2 C=3
D -> B, port 4                           port 2       A=1 B=2 C=3 D=4

Note: B is not learned from the first frame. The switch learns only from the source address; B enters the table only when it sends a frame itself.

Collision domain and broadcast domain

On a full-duplex switch connection (separate send and receive wires between host and switch) collisions never occur; CSMA/CD is effectively disabled.

A VLAN (virtual LAN) logically splits a single physical switch into several switches. Different VLANs are different broadcast domains; traffic between them must pass through a router. Organizations use them to separate guest, student and management networks: a security boundary.

ARP: from IP address to MAC address

A host wants to send an IP datagram to a host on the same subnet. It needs to write the destination MAC in the frame but knows only the IP. ARP (Address Resolution Protocol) does this mapping.

1. The host looks in its ARP cache. If there is an entry, it uses it.
2. If not, it broadcasts an ARP request: destination MAC FF:FF:FF:FF:FF:FF, content “Who has 10.0.0.9? I’m 10.0.0.5, my MAC is this.”
3. Everyone on the LAN receives the request, and only 10.0.0.9 answers. The ARP reply goes directly to the asker as a unicast.
4. The asker stores the mapping in its cache with a TTL (minutes).

ARP is plug-and-play: the administrator configures nothing.

Sending to another subnet

H1 (192.168.1.10/24) is writing to a web server (93.184.216.34). Since the destination is on a different subnet:

1. H1 checks its mask: the destination is not in my subnet -> send to the default gateway
2. H1 does ARP for the gateway IP (192.168.1.1) and learns the MAC of the router interface
3. Frame: dst MAC = router interface, dst IP = 93.184.216.34
4. The router strips the frame, looks at the IP, and builds a NEW frame for the next link
   (new src MAC = router's outgoing interface, dst MAC = next node)

PITFALL · no ARP for the remote server. ARP works only within the same subnet; a broadcast does not cross a router. In an exam, the answer to “what is the dst MAC?” is the MAC of the gateway, not of the server. The addresses in the IP header, on the other hand, do not change along the way (except with NAT, week 5).

Link-layer attacks

Ethernet and ARP assume that everyone on the local network is honest. When that assumption collapses:

The common lesson: at the link layer, identity is claimed, not verified. That is why we rely on end-to-end encryption (week 12, TLS) for confidentiality and integrity.

Common mistakes