Part 2: Data Link & Network Layers

1. Switching (Layer 2): The Local Intelligence

A switch is a multi-port bridge that operates based on MAC addresses.

• How it works: A switch builds a CAM (Content Addressable Memory) Table (also known as a MAC Table). It maps MAC addresses to specific physical ports.
• The Process:

1. A frame arrives.
2. The switch looks at the source MAC and records which port it came from.
3. The switch looks at the destination MAC.
4. If found: Forwards only to that port (unicast).
5. If unknown: Broadcasts out all ports except the source (flooding).

• STP (Spanning Tree Protocol): The essential safety mechanism. It prevents Layer 2 loops (which cause broadcast storms) by logically blocking redundant paths.

---

2. Routing (Layer 3): The Global Map

Routers connect different broadcast domains and make path decisions based on IP addresses.

• Routing Table: The “brain” of the router. It stores:

• Directly Connected Networks: Automatically added.

• Static Routes: Manually configured by administrators.

• Dynamic Routes: Learned via protocols (OSPF, BGP).

• Administrative Distance (AD): The “trustworthiness” of a route. If a router learns about the same destination from two different protocols, it chooses the one with the lowest AD.

• Metric: If a protocol has multiple paths to the same destination, it uses a metric to decide the “cost” (e.g., OSPF uses bandwidth; RIP uses hop count).

---

3. Advanced Routing Protocols

• OSPF (Open Shortest Path First): A Link-State protocol. Every router knows the map of the entire area. It uses Dijkstra’s algorithm to calculate the shortest path. Highly efficient and fast-converging.
• BGP (Border Gateway Protocol): The protocol of the Internet. It connects different Autonomous Systems (AS). It cares more about policy and path attributes (e.g., “don’t route through country X”) than just pure speed.

---

4. VLANs (Virtual LANs)

VLANs allow you to partition a single physical switch into multiple logical networks.

• Why use them?

• Security: HR and Guest Wi-Fi are isolated.

• Performance: Smaller broadcast domains reduce CPU load on end devices.

• Trunking (802.1Q): The protocol used to carry multiple VLANs over a single physical link between switches. It adds a “tag” to the frame header identifying which VLAN it belongs to.

---

5. Modern Architectures

• SD-WAN (Software-Defined WAN): Traditional WANs rely on expensive, rigid circuits (MPLS). SD-WAN uses an abstraction layer to route traffic dynamically across any mix of internet (fiber, 5G, broadband) based on real-time quality.
• Layer 3 Switching: Combines hardware-based switching (ASICs) with routing logic. It performs Inter-VLAN routing at “wire speed,” making it the backbone of modern office LANs.

---

Key Interview Scenario: “Inter-VLAN Routing”

If a user on VLAN 10 cannot talk to a user on VLAN 20:

1. Check the Gateway: Is there a Layer 3 device (Router or MLS) configured to route between the subnets?
2. Check the Trunk: Is the link between switches configured as an 802.1Q trunk? Are the VLANs allowed on that trunk?
3. Check the ACL: Is there a firewall or Access Control List blocking traffic between these two specific subnets?

---

6. Error Detection (Parity, Checksum, CRC)

How does a receiver know a frame got corrupted in transit?

• Parity bit: one extra bit makes the total count of 1s even (even parity) or odd. Detects single-bit errors only; fails if two bits flip.
• Checksum: sum (or one’s-complement sum) of data segments transmitted alongside; receiver recomputes and compares. Used in the IP/TCP/UDP headers. Simple but weak against certain patterns.
• CRC (Cyclic Redundancy Check): treats data as a polynomial and divides by a fixed generator polynomial; appends the remainder. Detects bursts of errors and is used at the data-link layer (Ethernet frames). The strongest of the three.

Ladder: parity (weak) → checksum (medium) → CRC (strong). Interviewers like the “which one detects the most?” answer: CRC.

7. ARQ: Reliable Delivery Mechanisms

Automatic Repeat reQuest — how a receiver guarantees the sender resends lost/corrupt data.

• Stop-and-Wait (S&W): send one frame, wait for ACK before the next. Simple but slow (link is idle most of the time).
• Go-Back-N (GBN): send up to a window of N frames; on a loss, the receiver discards everything after the missing frame and the sender retransmits all N from the lost one. Simple, but wasteful on loss.
• Selective Repeat (SR): only the lost frame is retransmitted; the receiver buffers out-of-order frames. Most efficient, needs per-frame buffering and sequencing.

Trade-off: S&W = simplest/slowest; GBN = moderate window, wasteful on errors; SR = best throughput, most complex. TCP effectively uses a Go-Back-N-like / windowing scheme.

8. Distance-Vector vs Link-State Routing

The two families of routing algorithms:

• Distance-Vector (e.g., RIP, Bellman-Ford): each router tells its neighbors “my distance to every destination.” Routers share only their distance table. Simple but slow to converge and suffers count-to-infinity (routers keep incrementing a broken route’s cost).
• Link-State (e.g., OSPF, Dijkstra): each router floods the whole network with info about its own links; every router builds the complete topology map and runs Dijkstra. Faster convergence, more CPU/memory, no count-to-infinity.

	Distance-Vector	Link-State
What’s shared	Distance table to neighbors	Link state to all routers
Algorithm	Bellman-Ford	Dijkstra
Convergence	Slow	Fast
Problem	Count-to-infinity	More resource-heavy

• Anycast vs Multicast: anycast = several servers share one IP; you get the nearest one (used by DNS/CDN). Multicast = one sender to a group of interested receivers (streaming).

9. SDN (Software-Defined Networking)

• Control plane (decides where traffic goes — the routing logic) is separated from the data plane (the hardware that actually forwards packets).
• A central SDN controller programs switches’ forwarding tables via protocols like OpenFlow, making the network programmable and centralized.
• Benefit: easier policy changes, central visibility, vendor-agnostic forwarding — at the cost of controller dependence and a potential single point of failure.