The Data Link Layer: Frames and MAC Addresses

The data link layer, layer 2, moves data from one device to the next device on the same link. It wraps each packet in a frame, whose header names the sending and receiving network cards by their MAC addresses and whose trailer lets the receiver detect damage. A frame never travels further than one link.

A MAC address (media access control address) is 48 bits written as six pairs of hexadecimal digits, such as 02:00:00:aa:00:01. It names one network interface, a single network card or radio, and has meaning only on the link that card is attached to. An IP address is different: it names a machine across many networks, and every router on the path reads it. A laptop with a cable and Wi-Fi has two MAC addresses, one per interface.

The receiving card reads the destination MAC first. If it is its own address, or the broadcast address ff:ff:ff:ff:ff:ff that every card accepts, it checks the frame check sequence and passes the payload up; otherwise it ignores the frame. A frame that fails the check is dropped, not repaired, and if anything resends the data it is a layer higher up, such as TCP.

The manufacturer sets a MAC address in the card, but software can change it, and most phones and laptops now use a random MAC for each Wi-Fi network they join so they cannot be tracked between networks. So a MAC address identifies an interface on a link, not a person or a device for life.

Ethernet on cables and Wi-Fi both work at this layer. Wi-Fi frames carry more address fields, for the access point among others, but the idea is the same: the frame is addressed to the next device, and to nothing further away.

So when data reaches the right building but not the right machine, the frame is the place to look: which MAC address it was sent to, and whether that card ever saw it.