Layer 2 is the data link layer of the OSI reference model, responsible for delivering frames between devices on the same local network segment using hardware addresses. In networking, and in Ethernet and switching in particular, Layer 2 is where Ethernet frames, MAC addresses, switches and VLANs operate: a switch forwards traffic by reading the destination MAC address, without looking at IP addresses.
Layer 2 sits between the physical layer, which moves bits over copper, fiber or radio, and Layer 3, which routes packets between networks. Its scope ends at the broadcast domain: every device that receives a broadcast frame belongs to the same Layer 2 network, and reaching anything beyond it requires a router or Layer 3 switch.
What Layer 2 does in an Ethernet network
The data link layer performs framing, addressing and error detection. It wraps each Layer 3 packet in a frame with source and destination MAC addresses, a type field and a frame check sequence (FCS), a 32-bit CRC that lets the receiver discard corrupted frames. Ethernet detects errors but does not retransmit; recovery is left to higher layers such as TCP.
The IEEE divides the layer into two sublayers: Logical Link Control (LLC), defined in IEEE 802.2, and Media Access Control (MAC), defined per technology such as IEEE 802.3 for Ethernet and IEEE 802.11 for wireless LANs. The table below shows the main fields of an Ethernet frame.
| Field | Size | Purpose |
|---|---|---|
| Destination MAC | 6 bytes | Receiving interface or group |
| Source MAC | 6 bytes | Sending interface |
| 802.1Q tag (optional) | 4 bytes | VLAN ID and priority |
| EtherType | 2 bytes | Payload protocol, for example 0x0800 for IPv4 |
| Payload | 46 to 1500 bytes standard | Layer 3 packet; jumbo frames up to about 9000 bytes |
| Frame check sequence | 4 bytes | CRC for error detection |
How Layer 2 switching forwards frames
A switch builds a MAC address table, also called a CAM table, by noting the source address of each incoming frame and the port it arrived on. For each frame it then decides between forwarding, filtering and flooding. Entries age out after a timer, commonly 300 seconds, so the table follows devices that move.
| Destination type | Switch action | Result |
|---|---|---|
| Known unicast MAC | Forward to the learned port only | Efficient, private delivery |
| Unknown unicast MAC | Flood to all ports in the VLAN | Reaches the device until it is learned |
| Broadcast FF:FF:FF:FF:FF:FF | Flood to all ports in the VLAN | Used by ARP and DHCP |
| Multicast | Flood, or forward selectively with IGMP snooping | Group traffic such as video |
| Destination on the arrival port | Filter, do not forward | Prevents needless traffic |
Because frames carry no time-to-live field, a physical loop between switches would circulate broadcasts indefinitely and cause a broadcast storm. The Spanning Tree Protocol family (IEEE 802.1D, Rapid STP in 802.1w and MSTP) prevents this by blocking redundant links until they are needed.
Layer 2 compared with Layer 3
The most common design question is where Layer 2 should end and Layer 3 should begin. The differences below explain why modern networks keep Layer 2 domains small and route between them.
| Aspect | Layer 2 | Layer 3 |
|---|---|---|
| Address used | MAC address, flat 48 bits | IP address, hierarchical |
| Device | Switch or bridge | Router or Layer 3 switch |
| Scope | One broadcast domain or VLAN | Between networks |
| Loop protection | Spanning tree, no TTL in frames | TTL or hop limit in packets |
| Path use | Blocked redundant links | Equal-cost multipath possible |
| Failure impact | Storm can affect whole domain | Contained to routing scope |
Layer 3 switches blur the boundary by performing both functions in hardware: switching within a VLAN and routing between VLANs at line rate.
Layer 2 features used in practice
Managed switches add Layer 2 features that segment, protect and scale the network. VLANs (IEEE 802.1Q) split one physical switch into several broadcast domains, and trunk ports carry many VLANs with tags.
| Feature | What it does | When to use it |
|---|---|---|
| VLAN tagging | Separates traffic into logical networks | Users, voice, guests and servers |
| Link aggregation (LACP) | Bundles links into one logical link | More bandwidth and redundancy |
| Rapid spanning tree | Blocks loops and recovers in seconds | Any network with redundant links |
| Port security | Limits MAC addresses per port | Public or shared access ports |
| DHCP snooping and ARP inspection | Blocks rogue servers and ARP spoofing | Access layer of enterprise networks |
| 802.1X port authentication | Requires devices to authenticate | Controlled office access |
Risks and common mistakes
Layer 2 problems tend to spread widely because everything in a broadcast domain shares fate. Most incidents come from loops, oversized domains and missing access-layer protection.
- Disabling spanning tree to simplify configuration leaves the network one patch cable away from a storm.
- Very large VLANs spanning many buildings increase broadcast load and widen the impact of failures.
- MAC flooding attacks overflow the address table and turn a switch into a hub unless port security is enabled.
- Native VLAN mismatches on trunks leak traffic between VLANs and enable VLAN hopping.
- MTU mismatches with jumbo frames cause silent drops of large frames only.
The simple explanation
Think of a single office floor. Everyone sits in the same open space, and internal mail is delivered by name tag on each desk, without the postal system. Layer 2 is that internal delivery, where every device on the local network has a fixed name tag, its MAC address.
A switch acts like the floor’s mail clerk. It learns which desk each name tag belongs to and delivers each letter only there. When a letter must go to another building, it is handed to a router, which works at the next level up, Layer 3.
How it is used in practice
A manufacturing company runs one flat Layer 2 network across three halls, with about 900 devices in a single VLAN. One morning a technician connects a spare cable between two wall ports, and because spanning tree had been disabled years earlier, a broadcast storm stops production lines for 40 minutes.
The network team redesigns the plant. Each hall receives its own VLANs for machines, offices and cameras, Rapid Spanning Tree with BPDU guard protects access ports, and a Layer 3 switch routes between VLANs. Uplinks use LACP bundles for redundancy. A later test loop is shut down within a second on a single port, and no other hall notices the event.