Overview
At the Data Link layer, the unit of data is the frame. Frames carry packets across a single local link, adding the local addressing needed for hop-by-hop delivery. Ethernet — the dominant wired LAN technology — defines the frame format most networks use.
Learning objectives
- Define an Ethernet frame and its structure.
- Explain the frame's role in local delivery.
- Understand where frames begin and end their journey.
Core concept
A frame wraps a network-layer packet with Data Link (Layer 2) information for delivery across one local segment. A simplified Ethernet frame contains:
- Destination MAC address — the local recipient.
- Source MAC address — the local sender.
- Type/Length — indicates the payload protocol (e.g. IPv4).
- Payload — the encapsulated IP packet.
- Frame Check Sequence (FCS) — a checksum to detect corruption.
How it works
Frames handle local, hop-by-hop delivery. When a packet needs to cross a network, it is placed inside a frame addressed (by MAC) to the next device on the local link — often a switch or router. That device receives the frame, checks the FCS for errors, removes the frame, and (if forwarding onward) builds a new frame for the next hop. So a frame's lifespan is a single link; the IP packet inside it survives the whole journey while frames are created and discarded at each hop.
Practical example
Your laptop sends data to a website. It builds a frame with its own MAC as source and the router's MAC as destination (because the website is not local), carrying the IP packet inside. The router receives the frame, discards it, and creates a new frame toward the next hop. Frame after frame is built and torn down across the internet, each carrying the same unchanged IP packet toward its destination.
Cybersecurity relevance
Frames and their MAC addresses are the arena for Layer 2 attacks such as MAC spoofing and ARP poisoning (later lessons). Because frames operate on the local segment, these attacks require local access but can be powerful — intercepting or redirecting traffic between hosts on the same LAN.
Common mistakes
- Confusing a frame (L2, local) with a packet (L3, end-to-end) — the packet rides inside frames that change at each hop.
- Overlooking the FCS — it is what lets a receiver detect a corrupted frame.
Key takeaways
- A frame is the Data Link unit that carries an IP packet across one local link, using MAC addressing.
- Ethernet frames include source/destination MACs, a type field, the payload, and an FCS checksum.
- Frames are created and discarded at each hop while the enclosed packet persists end to end.
Check your understanding
- What is the difference between a frame and the packet it carries?
- When your laptop sends data to a remote website, whose MAC address is the destination in the first frame, and why?