Getting Bits Across the Wire
Think of Layer 1 as the road and Layer 2 as the traffic rules for vehicles on that road. The road doesn't care what's in the truck — it just provides the physical surface. The traffic rules determine which truck goes where on that specific road segment.
Layer 1: The Physical Layer
Layer 1 is the raw transmission of bits (0s and 1s) over a physical medium. It defines the electrical voltages, light pulses, or radio frequencies that represent binary data. It has no concept of addresses, errors, or meaning — it just moves energy.
- Unit: Bit
- Hardware: Ethernet cables (Cat5e, Cat6), fiber optic cables, WiFi radio transceivers, hubs, repeaters
- Failure modes: "No carrier" errors, "Cable unplugged" OS notifications, physical interference (electromagnetic noise near unshielded cables), signal attenuation over long cable runs
- Diagnostic: Look at the link light on your NIC or switch port. No light = Layer 1 problem. On Linux,
ethtoolreports whether a link is detected at all, along with the negotiated speed and duplex — if link detection comes back negative, the problem is physical: a bad cable, the wrong port, or a dead NIC.
Layer 2: The Data Link Layer
Layer 2 organizes raw bits into structured frames and handles delivery between devices on the same local network segment. It introduces the concept of addressing for the first time, using MAC addresses (Media Access Control addresses).
A MAC address is a 48-bit hardware identifier burned into every network interface card at the factory. It looks like 00:1A:2B:3C:4D:5E — six pairs of hexadecimal digits. Unlike IP addresses, MAC addresses are not hierarchical and cannot be routed across the internet. They are only meaningful within a single network segment.
- Unit: Frame
- Address: MAC address
- Hardware: Network switches
- Protocols: Ethernet, ARP (Address Resolution Protocol), 802.11 (WiFi at L2), VLANs (802.1Q)
How switches use MAC addresses: A switch maintains a MAC address table (also called a CAM table). When a frame arrives on a port, the switch reads the source MAC address and records which port it came from. When it needs to forward a frame to a destination MAC, it looks up the table and sends the frame only to the correct port — not to every device on the network. This is what makes switches more efficient than hubs (which broadcast everything to everyone).
ARP — the bridge between Layer 2 and Layer 3: When your computer wants to send data to 192.168.1.1 (a Layer 3 address), it first needs to know the MAC address of that device to construct a Layer 2 frame. ARP broadcasts a request: "Who has IP 192.168.1.1? Tell me your MAC address." The device with that IP responds with its MAC. Your computer caches this mapping in its ARP table.
A missing ARP entry for your default gateway means Layer 2 is broken even if Layer 1 is fine — a common scenario with misconfigured VLANs.
Senior depth — VLAN tagging: In enterprise environments, a single physical switch can be divided into multiple isolated virtual networks using VLANs (Virtual Local Area Networks, IEEE 802.1Q). Frames are tagged with a VLAN ID (a 12-bit number, supporting up to 4094 VLANs). A device on VLAN 10 cannot communicate with a device on VLAN 20 at Layer 2 — they are logically separate networks. To route between VLANs, you need a Layer 3 device (a router or a Layer 3 switch). Misconfigured VLAN tagging is one of the most common causes of "the cable is plugged in but nothing works" incidents in enterprise networks.