What the Link Layer Does
- The link layer moves one datagram across one link: from a host to its router, from a router to the next router. IP decides the whole path; the link layer only does the next step.
- It wraps the packet in a frame and provides framing (where a frame starts and ends), link access (who may send on a shared medium), local addressing (which interface on this link) and error detection (a checksum, the FCS). Reliable delivery is optional: Wi-Fi retransmits, wired Ethernet does not.
- A link is one connection the packet crosses without a router in between. A whole switched LAN or Wi-Fi network is still one link. A hop is one link traversed.
- Each link may use a different protocol, so the frame (its addresses, its checksum) is rewritten on every link. The IP packet inside stays the same, apart from TTL and checksum updates and any NAT.
- The link layer lives mostly in the NIC (hardware and firmware) plus a driver in the kernel, which is why captures and counters sometimes look odd.
Mental model
A parcel travelling across a city goes by truck, then bike, then on foot. Each leg has its own vehicle, its own rules (road laws, bike lanes, a building's door code) and its own label stuck on the outside saying which depot or door it goes to next. The parcel inside never changes. Nobody on a leg needs to know where the parcel finally ends up, only who takes it next.
Where it breaks: a courier leg is chosen by someone who knows the whole route. A link does not know the final destination at all. It is handed a packet and the identity of the next hop, and that is its entire world. Also, a courier does not check the parcel for damage every leg; a link layer usually does check each frame.
Think of each hop as a function call where the callee re-wraps the payload in a new envelope: the outer type changes (Ethernet frame, 802.11 frame, PPP frame) while the inner value (the IP packet) is passed through untouched. It is also like running one TCP stream over a chain of different transports, each with its own framing, except that here the chain is rebuilt hop by hop by the network, not by the endpoints.
Where it breaks: a function call can see its caller's whole stack. A link sees only its own frame. And unlike a pure function, a link can drop the payload when the checksum fails, and usually says nothing about it.
How it works
Layers, encapsulation and the OSI vs TCP/IP models shows how each layer wraps the one above. The link layer is the bottom wrapper: it takes an IP packet from the network layer and turns it into a frame that one specific link knows how to carry.
Frame, packet, segment
These three words name the data unit at three layers, nested like envelopes.
| Unit | Layer | Carries | Rewritten at each router? |
|---|---|---|---|
| Segment (TCP) or datagram (UDP) | Transport | Application bytes plus ports | No. End to end. |
| Packet (IP datagram) | Network | A segment plus source and destination IP | TTL and header checksum change; addresses stay (unless NAT) |
| Frame | Link | A packet plus link-layer addresses and an FCS | Yes. Built fresh for every link. |
A frame is not a packet. The frame wraps the packet; take the frame header and trailer off and the packet is still there, unchanged.
The five services
Textbooks list what a link layer may provide. Not every link protocol provides all of them.
| Service | What it does | Done by | Example |
|---|---|---|---|
| Framing | Marks where a frame starts and ends and wraps the packet with a header (and often a trailer) | NIC | Ethernet header and FCS; PPP frames (RFC 1661) |
| Link access | Decides who may transmit when several senders share one medium | NIC (MAC protocol) | 802.11 CSMA/CA; none needed on a full-duplex switched Ethernet cable |
| Local addressing | Names the next-hop interface on this link, not the final destination | NIC, filled in by the driver | 48-bit MAC address; ARP maps IP to MAC |
| Error detection | Adds redundancy so the receiver can notice a corrupted frame and drop it | NIC hardware | Ethernet CRC-32 FCS |
| Reliable delivery | Acknowledges and retransmits a frame lost on this link | NIC and firmware, on links that need it | 802.11 ACK and retry. Not in wired Ethernet. |
Detection is the usual case. Correction is rare at the link layer; most links simply drop a bad frame and let a higher layer recover. The mechanisms are on Error Detection.
One packet across several links
Follow a packet from a laptop to a server far away. Every link has its own frame; the IP packet rides inside all of them.
On each link the sender asks "who is next on this link?" and writes that into the frame. For the host's first step, how it chooses between the destination itself and its gateway, and why the frame carries the gateway's MAC while the IP header keeps the final destination, see How a Host Decides Where to Send a Packet. How a MAC is found from an IP address is on ARP and MAC Addresses. The IP header fields are on The IP Packet.
What a link is, and what is a hop
A link is a connection over which a frame travels with no router in the path. That is wider than "one cable". A laptop on Wi-Fi sending to its home router crosses a radio link to the access point and usually a cable from the access point to the router, but a switch or access point does not look at the IP packet, so all of that is one link and the router is one hop away. The device that spans the link-layer network (a switch, see Switches and MAC learning) forwards frames by MAC address. A VLAN makes one physical switch behave as several separate links (VLANs). A tunnel can be a link too, when one network carries another's frames as payload.
Link types
| Type | Shared medium? | Needs medium access rules? | Examples |
|---|---|---|---|
| Point-to-point | No. Exactly two ends. | No, or only trivially | PPP over a serial or fibre line; one full-duplex Ethernet cable between two devices |
| Shared broadcast | Yes. Many stations, one channel. | Yes. A medium access protocol decides who talks. | Wi-Fi (802.11), classic hub-based Ethernet, cable access networks |
| Switched LAN | Each cable is point-to-point; the LAN is one broadcast domain | Not on full-duplex cables. The switch queues and forwards. | A modern Ethernet office or home LAN |
Wi-Fi details (why a wireless channel needs CSMA/CA and ACKs) are on Wi-Fi 802.11. The frame layout itself is in Header Diagrams and the Ethernet fields on Ethernet frames and MAC addresses.
Where it lives
The IP stack hands the driver a packet and the next hop's address. The driver builds the frame descriptor and queues it for the NIC. The NIC adds what it can do in hardware (the FCS, often TCP and IP checksums, sometimes TCP segmentation) and puts the bits on the medium. The receive side runs the other way: the NIC checks the FCS, drops bad frames and interrupts the driver with good ones.
Worked example: a 1,400-byte IP packet
Ethernet II adds a 14-byte header (destination MAC 6, source MAC 6, EtherType 2) and a 4-byte FCS (IEEE 802.3; the IP-over-Ethernet encapsulation is RFC 894).
| Link | Pieces | Frame size |
|---|---|---|
| Ethernet | 14 header + 1400 packet + 4 FCS | 1418 bytes (inside the 64 to 1518 byte limit) |
| Ethernet, time on a 1 Gb/s wire | (1418 + 8 preamble and start delimiter + 12 inter-frame gap) x 8 bits, divided by 1e9 bit/s | 11.504 microseconds |
| Wi-Fi (802.11 QoS data frame, 3 addresses) | 26 MAC header + 8 LLC/SNAP + 1400 packet + 4 FCS | 1438 bytes |
| Wi-Fi with WPA2 CCMP | the 1438 above + 8 CCMP header + 8 integrity check | 1454 bytes |
The Ethernet figures follow directly from the standard. The Wi-Fi rows are derived from the 802.11 field sizes (24-byte base MAC header, plus 2 bytes of QoS control) and the 8-byte LLC/SNAP header that RFC 1042 specifies for IP over 802 networks; they are illustrative, since a real frame varies with the options in use (a capture in monitor mode will show the exact bytes). The point stands either way: the same 1,400-byte packet becomes a different-sized frame on every link.
Deep dive
Hop-by-hop versus end-to-end
Error checks are layered because they guard different things.
| Check | Scope | Recomputed when? |
|---|---|---|
| Ethernet FCS (CRC-32) | One link. Covers the frame. | At every link; a bad frame is dropped there |
| IPv4 header checksum | One hop. Covers the IP header only. | At every router, because TTL changes |
| TCP and UDP checksum | End to end. Covers a pseudo-header and the payload. | Only by the endpoints (or a NAT, which must patch it) |
| TLS record integrity | End to end. Covers the application data. | Only by the endpoints |
The link-layer check protects a frame on the wire. It cannot catch corruption inside a router's memory or a bug in a switch, which is why the endpoints still check. This is the end-to-end argument of Saltzer, Reed and Clark (1984): reliability built at a low layer is at best a performance optimisation, because the endpoints must check anyway. So wireless links retransmit locally not for correctness but because without it TCP would see far too much loss and slow down.
Why Ethernet does not retransmit and Wi-Fi does
IEEE 802.3 Ethernet has no acknowledgements: a receiver that finds a bad FCS drops the frame and nobody tells the sender. That is affordable because physical Ethernet is designed for a very low bit error ratio (the 802.3 physical layer specifications target figures on the order of 1e-10 to 1e-12 depending on the PHY), so frames are rarely corrupted. A wireless channel is far noisier, and a sender cannot reliably tell that a frame collided at the receiver (the hidden terminal problem on Wi-Fi 802.11). So IEEE 802.11 acknowledges every unicast frame with a link-layer ACK and retries when none arrives.
Link MTU
Every link has a maximum payload, its MTU. Standard Ethernet carries 1500 bytes (RFC 894); PPPoE links lose 8 bytes to their own header and carry 1492 (RFC 2516). Because every link on the path can differ, a packet that fits one link may not fit the next. Fragmentation and Path MTU Discovery are the answer and are owned by MTU, MSS and Fragmentation; ICMP's part is on ICMP, Ping, TTL and PMTUD.
NIC offloads
To save CPU, modern NICs and drivers do work that the textbook puts in the host stack: computing and verifying checksums, TSO (the stack hands down one large buffer and the NIC cuts it into MTU-sized frames) and GRO (the receive path merges several arriving packets into one larger one before the stack sees them). A capture taken on the host can therefore show a "packet" larger than the MTU, or a TCP checksum that looks wrong because the NIC had not yet filled it in. See the kernel's checksum offloads and segmentation offloads documents.
Textbook vs real world
| The textbook says | Production does | Why |
|---|---|---|
| The link layer provides reliable delivery | Wired Ethernet gives none, only detection. Wi-Fi and cellular retransmit. | Reliability is only worth the cost on lossy media. TCP provides the real guarantee. |
| One link protocol per network | Every hop can use a different one: Wi-Fi, Ethernet, fibre framing, a tunnel. | IP was designed to run over anything that can carry a packet. |
| The NIC is a dumb card | Offload engines do checksums, segmentation and more. SR-IOV gives a VM its own slice. SmartNICs run whole network functions. | Per-packet CPU work does not scale to tens of gigabits per second. |
| A link is one cable | A link may be a whole switched LAN, a VLAN or a tunnel. | What defines a link is that no router sits in between, not the wire. |
In production
- Linux puts the link layer in the kernel's network device and driver path, with NAPI polling to cut interrupts at high packet rates (kernel NAPI documentation).
- AWS moved virtual networking, storage and management for EC2 onto dedicated Nitro cards instead of the host CPU, so the VM's network interface is largely implemented in hardware (AWS Nitro System).
- Large data centres often make every switch-to-switch link a routed (layer 3) link in a leaf-spine fabric, so most hops are IP hops and a layer 2 domain is confined to a rack or less. RFC 7938 documents running eBGP over such a fabric.
History and evolution
- 1971 ALOHAnet in Hawaii shows several stations can share one radio channel by transmitting at random and retrying on collision. Its idea of random access is the ancestor of Ethernet's.
- 1973 Bob Metcalfe and colleagues at Xerox PARC design Ethernet as a shared coaxial bus with collision detection; the design is published in 1976 (Metcalfe and Boggs, CACM). Shared medium scaled poorly as traffic grew: every station heard every frame and collisions rose with load.
- 1983 to 1990 IEEE standardises Ethernet as 802.3, and twisted-pair 10BASE-T (802.3i, 1990) replaces coax with a star of cables around a hub.
- 1988 to 1994 Serial lines carry IP with SLIP (RFC 1055), which has no error detection or protocol field, then PPP (RFC 1661, 1994) adds framing, link negotiation and multiple network protocols.
- 1990s Switches replace hubs, so each cable becomes a private point-to-point link and collisions disappear on full-duplex links.
- 1997 and 1999 IEEE 802.11 is first published (1997) and 802.11b (1999) makes Wi-Fi practical, bringing a shared medium back, now needing CSMA/CA and ACKs.
- Now Wired links are switched point-to-point everywhere, from home to data centre. Speeds are defined by 802.3 amendments, with 400 Gb/s (802.3bs, 2017) and 800 Gb/s (802.3df, 2024) already standardised.
- Next Ethernet moves into cars and factories as single-pair Ethernet (for example 802.3bw 100BASE-T1, 2015) and deterministic scheduling from the IEEE 802.1 TSN family.
Hands-on
macOS output below was captured on 2026-10-14. The MAC address is replaced by the documentation-style placeholder 02:00:00:00:00:aa.
mtu 1500 is the link MTU, ether is the interface's MAC, and options lists offloads in play: TSO4 and TSO6 are TCP segmentation offload, PARTIAL_CSUM is checksum offload. This is why a capture on this machine can show unfilled checksums.
Ierrs and Oerrs count frames the interface found bad or could not send. Both are 0 here. A rising Ierrs on a wired port points at a bad cable or duplex mismatch. Columns are trimmed to fit.
On Linux the equivalents are below. The output is not reproduced here because it varies by driver; what to look at is listed after the commands.
ip -br link gives one line per interface with state and MAC. ip -s link show adds counters: errors are frames the NIC found corrupt (FCS, length, alignment), dropped are frames discarded by the driver or kernel (often a full ring buffer or queue), overruns are frames the NIC itself lost because the host did not drain its buffer in time. ethtool -i names the driver and firmware version. ethtool -k lists offload settings; look at rx-checksumming, tx-checksumming, tcp-segmentation-offload and generic-receive-offload.
Gotchas
Interview questions
Show answer
The network layer picks the path across many networks. The link layer moves a packet across one link to the next hop. It does framing, local addressing by MAC address, medium access on shared media, and error detection with a frame checksum.
Follow-ups:
- Who adds the frame header? The NIC and its driver, on the host that is sending onto that link.
- What changes per hop and what stays? The frame (MAC addresses, FCS) changes at each router. The IP source and destination stay the same, apart from a NAT.
Show answer
They are the data units at the link, network and transport layers, nested like envelopes. A segment sits in a packet and a packet sits in a frame.
Follow-ups:
- Which header is rewritten at every router? The frame header. The router discards the incoming frame and builds a new one for the outgoing link.
Show answer
An IP address names a destination across the whole Internet and depends on where you are in the topology. A MAC address identifies an interface on the local link, so the link layer can deliver a frame to the right device on that segment. The link may not even run IP, and some links, like PPP, need no addresses at all.
Follow-ups:
- What happens to the MACs across a router? The sender's MAC and the destination's MAC are replaced with ones for the next link. The router builds a new frame.
Show answer
Wired Ethernet has a very low bit error rate, so a link-layer ACK and retry would cost more than it saves; it detects bad frames with the FCS and drops them. Wireless is lossy and a sender cannot tell that a frame was corrupted or collided, so 802.11 requires an ACK for each unicast frame and retries when it is missing.
Follow-ups:
- Then why does TCP still checksum? The FCS only guards one link. Corruption inside a router or switch is invisible to it, so the endpoints must still check (the end-to-end argument).
Show answer
In the network interface card, which is hardware plus firmware, together with a driver in the operating system kernel. The IP stack hands the driver a packet; the NIC builds the final frame, adds the FCS and transmits.
Follow-ups:
- What is checksum offload and why does tcpdump show bad checksums? The NIC computes the TCP or IP checksum after the host captured the outgoing packet, so the captured copy still has an unfilled or partial checksum. The packet on the wire is correct.
Show answer
The Ethernet FCS is checked at every link. The IPv4 header checksum is checked and recomputed at every router because TTL changes. The TCP and UDP checksum covers a pseudo-header and the payload and is verified only by the endpoints. TLS adds an end-to-end integrity check on the data itself. IPv6 dropped the header checksum for this reason.
Follow-ups:
- What is the end-to-end argument? Functions such as reliability can only be completely implemented at the endpoints, so lower-layer versions are optimisations, not substitutes.
Show answer
Yes. If a packet is too large for the next link and the DF bit is clear, the router can fragment it. If DF is set, the router drops it and sends ICMP Destination Unreachable, type 3 code 4 (fragmentation needed). The sender lowers its packet size; this is Path MTU Discovery.
Follow-ups:
- What breaks if ICMP is blocked? The sender never learns the smaller MTU, large packets silently vanish, and connections stall after the handshake. This is the PMTUD black hole.
Fun facts
- Ethernet's name comes from the luminiferous ether, the medium once imagined to carry light; the choice is explained in the Metcalfe and Boggs paper cited above.
- The 64-byte minimum frame is not arbitrary. At 10 Mb/s the 51.2 microsecond slot time holds exactly 512 bits, which is 64 bytes (worked through on Ethernet frames and MAC addresses).
- A 48-bit MAC space holds 248 = 281,474,976,710,656 addresses.
Cheat sheet
- 14 bytes - Ethernet II header (6 + 6 + 2)
- 4 bytes - Ethernet FCS (CRC-32)
- 64 to 1518 bytes - Ethernet frame, header and FCS included, preamble excluded
- 1500 bytes - standard Ethernet MTU (RFC 894)
- 48 bits - MAC address
- 5 - link services: framing, link access, local addressing, error detection, reliable delivery (optional)