Home > Articles > Certification > Cisco Certification > CCNA

  • Print
  • + Share This
This chapter is from the book

This chapter is from the book

Data Link Protocols

Objective: Compare and contrast key characteristics of LAN environments

In this section, you will learn about network protocols that can be utilized at the Data Link layer of the OSI model. These protocols include token ring, FDDI, and ethernet. Ethernet Data Link protocols are broken out into addressing and framing standards.

Token Ring

Token ring is a LAN protocol that utilizes a token-passing media access technology in a physical ring or physical star topology, which creates a logical ring topology. This protocol was first developed by IBM but then standardized by IEEE with the 802.5 specification. With token-passing, a three-byte token (or special bit pattern) is inserted in a frame and passed in a single direction from one node to another until it forms a complete loop. The node that has possession of the token is the only one that can send data at any given time on that LAN. Because only one node can send data at a time, collisions are avoided.

Rather than using a hub or switch, Token ring uses a multistation access unit (MAU) to send a token across the network. The MAU has Ring In (RI) and Ring Out (RO) ports. The RO of the first MAU is connected to the RI of the next MAU. This continues until the final MAU, which connects back to the first MAU RI port via its own RO port. As mentioned, a logical ring is created with this setup. Figure 3.1 shows how a token ring network operates with MAUs.

Figure 3.1

Figure 3.1 Token ring network.

A token ring LAN can run at either 4Mbps or 16Mbps. Each device must be configured for the same speed; otherwise the token-passing does not work at all. Overall, although this protocol provides a collision-free network, it is also more expensive to implement than ethernet. This is a major reason why ethernet is the most popular Data Link layer protocol, making token ring a rather distant second.

Let’s recap what you’ve learned about token ring:

  • Standardized by the IEEE 802.5 specification
  • A token-passing media access technology
  • Set up as a physical ring or physical star topology
  • Creates a logical ring topology
  • Speeds are assigned as either 4Mbps or 16Mbps
  • Utilizes an MSAU rather than a switch or hub
  • Provides collision-free data transfer
  • High overhead


FDDI is a LAN protocol that utilizes a token-passing media access method on a dual ring topology. This protocol was created by the American National Standards Institute (ANSI) with the ANSI X3T9.5 specification. Data transmission occurs on fiber-optic cables at a rate of 100Mbps. Primarily, FDDI was developed to run data across the network backbone of a larger company. Dual ring is configured for FDDI to provide redundancy and fault-tolerance. Also, because it runs over fiber it is not susceptible to EMI like other media options. Figure 3.2 shows the dual ring topology of an FDDI network.

Figure 3.2

Figure 3.2 FDDI network.

FDDI uses a method called beaconing to signal when a failure is detected on the network. Beaconing enables a device to send a signal informing the other devices on that LAN that token passing has stopped. The beacon travels around the loop from one device to the next until it reaches the last device in that ring. To troubleshoot, the network administrator can find the beacon at that last device and then check the connection between that device and the next connected device on the FDDI network.

Like token ring, FDDI is costly to implement, which is a disadvantage when designing a small network.

Let’s recap what you’ve learned about FDDI:

  • Developed by ANSI with the ANSI X3T9.5 specification
  • A token-passing media access technology
  • Set up as a dual ring topology
  • Redundant, fault-tolerant network
  • Speed is 100Mbps
  • Runs over fiber-optic cable
  • Not susceptible to EMI
  • Provides collision-free data transfer
  • Fault-detection provided by beaconing
  • High overhead

Ethernet at the Data Link Layer

Objective: Describe network communications using layered models

Ethernet, ethernet, ethernet...

The most popular LAN by a mile, ethernet is a group of protocols and standards that work at either the Physical or Data Link layer of the OSI model. This section covers ethernet technology that is relevant to Layer 2. Ethernet is defined by the IEEE 802.3 specification. As technology advancements occur, IEEE has defined additional classifications of 802.3, which include Fast Ethernet, Gigabit Ethernet, 10-Gigabit Ethernet, and Long Reach Ethernet. The physical implementations of each Ethernet standard are covered in greater detail in a moment, but first I would like to review ethernet addressing and ethernet framing. Ethernet addressing can be achieved with unicast, multicast, or broadcast addresses at the Data Link layer.

Ethernet Addressing

The Data Link layer uses physical or hardware addressing to make sure data is delivered to the appropriate end device in a LAN. Physical addresses or what are commonly referred to as MAC addresses are used at Layer 2. Before you go any further, it’s a good idea to take a minute to review what you learned in Chapter 1.

The Data Link layer of the OSI model is the only one that has sublayers. Table 3.1 shows the breakout of Layer 2.

Table 3.1 Data Link Layer and Sublayers

OSI Model Layer


Data Link Layer

Media Access Control (MAC) IEEE 802.3


Logical Link Control (LLC) IEEE 802.2

A MAC address is hard-coded (burnt in) on the network interface controller (NIC) of the Physical Layer device attached to the network. Each MAC address must be unique and use the following format:

  • The address must consist of 48 bits (or 6 bytes).
  • It must be displayed by 12 hexadecimal digits (0–9, A–F).
  • The first 6 hexadecimal digits in the address are a vendor code or organizationally unique identifier (OUI) assigned to that NIC manufacturer.
  • The last 6 hexadecimal digits are assigned by the NIC manufacturer and must be different from any other number assigned by that manufacturer.

An example of a MAC address would be 00:00:07:A9:B2:EB. The OUI in this example is 00:00:07.

Ethernet LAN addresses can be broken down into two subcategories: individual and group addresses. An individual address is referred to as a unicast address. A unicast address identifies the MAC address of an individual LAN or NIC card. The source address on an ethernet frame will always be a unicast address. When a packet from the Network layer is framed for transport and is being forwarded to a single destination, a unicast address is also the destination address on an ethernet frame. Figure 3.3 represents an example of frame forwarding between a unicast source and a unicast destination device. Cisco devices typically use three groups of four hexadecimal digits separated by periods, such as 0000.0C12.3456. Cisco’s OUI is 0000.0C.

Figure 3.3

Figure 3.3 Unicast frame transmission.

In the example in Figure 3.3, Bill’s computer checks the destination address on the ethernet frame. If the destination address is the MAC on his computer, the frame is processed. If the destination address does not match up, the frame is dropped.

Group Ethernet LAN addresses classify more than one LAN or NIC card. Multicast and broadcast addresses are both classified as group addresses and can be described as follows:

  • Multicast addresses—Addresses where a frame can be sent to a group of devices in the same LAN. IEEE ethernet multicast addresses always begin with 0100.5E in hexadecimal format. The last three bytes can be any combination of hexadecimal digits. The IP routed protocol supports multicast addressing with three groups of four hexadecimal digits separated by periods (like Cisco devices), so it appears as 0100.5Exx.xxxx, where the x’s can represent any hex digit from 0–9 or A–F. Figure 3.4 shows a frame that is being forwarded from a unicast source to an IP multicast destination address.
  • Figure 3.4

    Figure 3.4 Multicast frame transmission.

    In this example, the switch sends a frame from its own unicast address to the multicast address of 0100.5E12.3456. Each device in that LAN segment checks the destination address to see whether it should be processed. Although Bill and Carol’s computer will review and process the frame, Dustin’s does not care about it and therefore drops the frame.

  • Broadcast addresses—Addresses where a frame is sent to all devices in the same LAN segment. Multicast and broadcast addresses are limited to a LAN or network segment. Broadcast addresses are always the same value, which is FFFF.FFFF.FFFF. Figure 3.5 shows a switch sending a frame to the destination address FFFF.FFFF.FFFF. Because this is the broadcast address value, all the devices in that LAN should process the frame.
Figure 3.5

Figure 3.5 Broadcast frame transmission.

Ethernet Framing

As you will recall from Chapter 1, data traverses the layers of the OSI model and is encapsulated from layer to layer.

Table 3.3 shows the process of using the OSI model to encapsulate data.

Table 3.3 OSI Model Layer and Related Control Information

OSI Layer

Control Information Name









Data Link




The Data Link layer uses frames to transport data between layers. Framing is the process of interpreting data that is either received or sent out across the network. The 802.2 LLC Data Link sublayer is an extension of 802.3 and is responsible for framing, error-detection, and flow control. Figure 3.6 represents an 802.3 frame.

Figure 3.6

Figure 3.6 802.3 frame.

The three main parts of an 802.3 frame can be broken down and described as follows:

  • The Data Link header portion of the frame contains the destination MAC address (6 bytes), source MAC address (6 bytes), and length (2 bytes).
  • The Logical Link Control portion of the frame contains Destination Service Access Point (DSAP), Source Service Access Point (SSAP), and control information. All three are 1 byte long. The Service Access Point (SAP) identifies an upper-layer protocol such as IP (06) or IPX (E0).
  • The data and cyclical redundancy check (CRC) portion of the frame is also called the data-link trailer. The data field can be anywhere from 43 to 1497 bytes long. The frame check sequence (FCS) field is 4 bytes long. FCS or CRC provides error detection.

Error detection is used to determine whether bit errors happened during frame transmission. The sender and receiver of a frame use the same mathematical formula to analyze the information in the FCS field of the data-link trailer. If the calculations match up, there were no errors on that frame transmission.

I mentioned how the SAP in the 802.3 frame identifies an upper-layer protocol with 1 byte or 2 hexadecimal digits. The IP SAP is 06. Well, it turns out that 1 byte was insufficient for the number of protocols that need to be recognized by an 802.3 frame. To accommodate the influx of protocols, IEEE permitted for an additional header in the 802.3 frame called a Subnetwork Access Protocol (SNAP) header.

The SNAP header serves the same purpose as the DSAP field; however, it consists of 2 bytes. For example, 0800 is the hexadecimal format assigned to IP with SNAP. RFC 1700 identifies all the values that are associated with SAP and SNAP.

  • + Share This
  • 🔖 Save To Your Account