Layer 2 and layer 3
How a switch learns MAC addresses and floods broadcasts, how IP subnets and default gateways decide where packets go, how VLANs split a switch into separate networks, and how trunks and a router connect them. Built on a real switch, three PCs and a VyOS router.
By the end you will be able to:
- Explain the difference between layer 2 (MAC addresses, switches) and layer 3 (IP addresses, routers)
- Read an IP address and prefix length, and predict whether a host will send directly or via its gateway
- Describe how a switch learns MAC addresses and when it floods frames
- Use VLANs and access ports to separate broadcast domains
- Explain 802.1Q trunks and route between VLANs with a router on a stick
- Troubleshoot common mistakes: wrong subnet, wrong VLAN, a VLAN missing from a trunk
Every network you'll ever build has two jobs, done by two kinds of address:
- Layer 2 (the data link layer) moves frames between devices on the same network segment. Devices are identified by their MAC address, a 48-bit number burnt into (or assigned to) each network card, like
02:00:00:00:00:01. A switch works at layer 2: it looks at the destination MAC address of each frame and sends it out of the right port. - Layer 3 (the network layer) moves packets between networks. Devices are identified by their IP address, like
10.10.0.11, which says both which network they're on and which host they are. A router works at layer 3: it looks at the destination IP address and decides which network to send the packet towards next.
| Layer 2 | Layer 3 | |
|---|---|---|
| Address | MAC (02:00:00:00:00:01) | IP (10.10.0.11/24) |
| Device | Switch | Router |
| Scope | One segment (one VLAN) | Between networks, all the way across the internet |
| Unit | Frame | Packet (carried inside frames) |
| Glue between them | ARP: "which MAC address has this IP?" |
A packet from one PC to another always travels inside a frame. If both PCs are on the same network, the frame goes straight from one to the other through the switch. If they're on different networks, the frame goes to the router (the PC's default gateway), which unwraps the packet, decides where it goes next, and sends it on inside a new frame.
This lesson builds a small office network: a switch (sw1), three PCs and a router (R1, VyOS). It starts as one flat network and ends with two VLANs and routing between them. Every output comes from that lab.
- ARP: a broadcast. pc1 asks "who has 10.10.0.12?" to ff:ff:ff:ff:ff:ff. The switch learns pc1's MAC on eth1 and floods the broadcast to every other port in the same VLAN.
- Unicast: straight to the right port. pc2 replies to pc1's MAC. Now the switch knows both, so the pings only use eth1 and eth2.
- VLANs separate broadcast domains. pc3's port is in VLAN 20, so VLAN 10's broadcasts never reach it, whatever IP address it has.
- Trunk: tagged frames. The link to R1 carries both VLANs. Each frame has an 802.1Q tag saying which VLAN it belongs to.
- Routing between VLANs. pc1 → pc3 goes up the trunk in VLAN 10, R1 routes it, and it comes back down the same trunk in VLAN 20.
Check your understanding
pc1 sends a packet to a host on a different network. Whose MAC address is the destination of the frame pc1 sends?
- The default gateway's (the router's)
- The far host's
- ff:ff:ff:ff:ff:ff
- The switch's