Link technologies

Framing: conceptual explanation

Framing tells a receiver where one link-layer data unit ends and the next begins. Length fields, delimiters with escaping, and physical-layer coding are different strategies; malformed or inconsistent lengths require rejection. A frame check sequence detects many accidental bit errors but is not an authenticated integrity guarantee.

Deep technical explanation

Physical links transmit changes on a medium; a link protocol must turn these into bounded frames. Frame delimiting lets the receiver recognize where one unit ends and another begins. A length field is simple but a corrupted length can misalign parsing. A delimiter approach needs escaping if payload bytes can imitate the delimiter. Bit stuffing and byte stuffing solve variants of this problem, each with its own overhead. Receivers must validate lengths before allocating memory or trusting checksums. The frame check sequence detects many accidental alterations, but a CRC is not an authentication tag and does not stop an attacker who can recompute it.

A link trace contains more than an application payload. Ethernet has addresses, an EtherType or length interpretation, a payload, and an integrity check; it may also carry VLAN tagging. Hardware often strips the frame check sequence before presenting packets to software, so the absence of a CRC in a host capture says little about physical transmission. Small frames can require padding; preambles and interframe gaps consume wire time but are not always shown in packet-capture file sizes. Distinguish captured bytes from on-the-wire bytes before calculating utilization.

When framing errors rise, compare interface counters, cabling, optics, and speed negotiation before blaming applications. A suspiciously high rate of malformed frames on one interface, with normal counters elsewhere, suggests a local link issue. A clean CRC does not guarantee a frame belongs to the expected protocol, and a frame arriving intact does not prove it arrived before its deadline. Reliability above the link still needs explicit sequence and timing semantics.

Controlled experiment and observation notebook

Write a byte-stuffing encoder for a single sentinel byte and an escape byte, including rules for payloads containing both. Test zero-length payloads, repeated delimiters, truncated escape sequences, and a length that exceeds the input buffer. Compare payload size before and after escaping for low and high sentinel frequencies. Next implement a simple CRC demonstration using a short polynomial, making clear that it is a classroom checksum rather than a cryptographic message authentication code. Explain why frame acquisition and integrity validation are separate receiver responsibilities. Record which malformed inputs are safely rejected before any large memory allocation.

Medium Access: conceptual explanation

Medium access is the mechanism by which stations share a channel. Contention mechanisms can collide or defer; scheduling mechanisms reserve resources but introduce coordination overhead. Compare performance at low and saturated offered load, because access delay and fairness can change dramatically with contention.

Deep technical explanation

Shared media create a coordination problem: two transmitters may interfere if they speak simultaneously. Classical Ethernet used CSMA/CD on shared half-duplex segments, whereas modern switched full-duplex Ethernet largely removes that collision domain. Wi-Fi uses collision avoidance procedures because a transmitter cannot reliably detect every wireless collision while sending. Backoff is a randomized scheduling mechanism, not a promise that collisions are impossible. Hidden terminals can each hear an access point but not each other; both may contend for the same receiver.

Pure ALOHA gives a useful mathematical warning about congestion. If independent attempts have Poisson offered load G transmissions per packet time, an idealized success rate is S=G exp(-2G). Differentiating gives dS/dG=exp(-2G)(1-2G), so the maximum occurs at G=0.5 with S=1/(2e), about 0.184 successful packets per packet time. This is not the performance of Wi-Fi or switched Ethernet. It isolates the cost of uncoordinated overlap, which is why scheduling, sensing, and collision-avoidance strategies matter.

Air-time fairness is different from throughput fairness. A slow wireless station occupies more airtime to send the same number of bytes. A throughput-only dashboard may hide that cost. Measurements should include channel utilization, retries, signal strength, latency distributions, and traffic mix. Changing transmit power can expand interference rather than fix congestion. Diagnose the medium and topology before applying a tuning value copied from another installation.

Controlled experiment and observation notebook

Use a simulated slotted timeline with two hidden wireless stations and a shared access point. Assign each station a list of planned transmission slots and compute when overlap occurs at the receiver. Change random backoff ranges and record collision count across many seeded runs. Ask why the simplified simulation does not capture real capture effects, modulation adaptation, hidden-node geometry, or carrier-sense thresholds. Contrast this environment with switched full-duplex Ethernet, where conventional shared collision reasoning no longer describes ordinary traffic forwarding. Treat the pure ALOHA equation as a deliberately separate mathematical baseline, not a Wi-Fi performance estimator.

Ethernet: conceptual explanation

Modern switched Ethernet forwards frames based on learned MAC-address tables. A switch floods unknown-destination frames within the relevant broadcast domain and learns source addresses, whereas an IP router forwards based on network-layer routes. VLANs create separate layer-two segments but are not substitutes for access-control policy.

Deep technical explanation

Ethernet forwarding is based on link-layer addresses. A bridge or switch learns the source MAC address of arriving frames and associates it with the ingress port; it then forwards known-destination unicast frames to the learned port. Unknown unicast and broadcast traffic may be flooded within a VLAN. Learned entries expire. The forwarding database is therefore an approximation based on observed sources, not a directory of globally unique machines. Layer-2 loops can repeatedly circulate flooded frames, creating storms until a loop-prevention mechanism breaks the cycle.

Virtual LANs divide a switching fabric into separate broadcast domains. A trunk can carry tagged traffic for several VLANs; an access port normally associates attached equipment with one VLAN. VLAN separation alone is not equivalent to cryptographic confidentiality or a complete security boundary. Inter-VLAN communication requires a Layer-3 function or a policy gateway. The network design should document which VLANs carry management, guest, application, and infrastructure traffic, and which routed policies permit communication among them.

Measure wire efficiency carefully. A gigabit-per-second port can carry less than a gigabit per second of application payload because of interframe gaps, headers, acknowledgments, protocol chatter, and downtime. A link can be operational yet drop packets because the switch buffer is saturated by bursts entering faster than the egress port drains. Compare input and output counters on both ends of the link. For an intermittent failure, an interface error counter that rises only during peak traffic is different evidence from a CRC error counter that rises whenever a cable is moved.

Controlled experiment and observation notebook

Construct a four-switch square and assign one host per access port. Record initial empty MAC tables, then the learning changes after each source frame. Add a loop between two switches without a prevention mechanism in a bounded simulator and describe how broadcast copies can multiply. Do not create an uncontrolled loop on production hardware. Repeat with VLANs that place two hosts in different broadcast domains and verify that an intervening routing function is required for IP communication. Distinguish a learned forwarding entry from a static security authorization rule; observing a MAC address does not prove the attached device is legitimate.

Wireless Links: conceptual explanation

Wireless links vary with interference, attenuation, antenna geometry and contention. Effective throughput differs from advertised physical rate because airtime includes headers, acknowledgments, backoff and retransmissions. Unlike a wired point-to-point link, observing a strong signal is not enough to infer low channel occupancy.

Deep technical explanation

A wireless link is spatial and shared. Received signal strength, background noise, interference, channel width, and modulation determine whether a chosen data rate can be sustained. A headline PHY rate is not an application throughput guarantee. Airtime is consumed by acknowledgments, contention, management frames, retries, and devices using slower coding rates. Two access points on overlapping channels can degrade one another even when their wired uplinks have abundant capacity. The right starting point is a survey of signal, noise, and channel occupancy in the relevant rooms at the times people actually work.

The hidden-node example demonstrates why carrier sensing is imperfect. Station A and station C both reach access point B, but A and C cannot detect each other. Each may judge the channel clear and transmit, creating interference at B. Request-to-send/clear-to-send procedures can reduce some hidden-node collisions at the cost of control overhead; they are not appropriate as a universal toggle. Interference from non-Wi-Fi devices or adjacent networks introduces additional uncertainty.

Mobility creates time-dependent decisions. An overly sticky client may remain associated with a distant access point even when a nearer one offers a better path. Roaming involves client choices, authentication, and often higher-layer state; a healthy beacon does not prove a stable application session. During troubleshooting record the device, location, band, channel, rate, retries, handoff timestamp, and application symptom. Separate high-latency radio retries from upstream DNS or Internet problems before changing the wireless design.

Controlled experiment and observation notebook

Measure a Wi-Fi deployment at three locations and two times of day, collecting received signal power, retry fraction, negotiated rate, application throughput, and p95 latency. Explain why the fastest advertised PHY rate is not the measured goodput. A laptop that moves between access points should be tested during the handoff, not only before and after association. Consider whether the problem follows the client, a physical area, a channel, or the wired uplink. Test a proposed channel change using the same representative clients and load; record regressions as well as improvements rather than declaring success from one nearby device.

Integrated case study

A link engineer designs for both typical traffic and adverse timing. Begin with a diagram of a switched Ethernet segment leading to a wireless access point. Identify where contention exists and where it does not. Full-duplex switched Ethernet has independent point-to-point links and does not share the original half-duplex collision domain, while wireless clients generally contend for radio airtime. List the kinds of overhead each path pays: Ethernet preamble and interframe gap, link framing, wireless acknowledgments, retries, contention, management traffic, and any VLAN or security encapsulation. Never compare PHY link rates directly with application throughput without separating these costs.

Suppose a 1500-byte frame is sent at 10 Mbit/s. The payload serialization component is 1500×8 / 10,000,000 seconds, or 1.2 ms; this is not total packet latency. At 100 Mbit/s, serialization is 0.12 ms. Add a 2 ms one-way propagation contribution and a variable queueing term to explain why higher link speed can produce only a modest change in small-request response time. At moderate load, a queue can be near empty most of the day and still overflow during short bursts. Use high-resolution egress queue counters to validate an alleged microburst rather than trusting a one-minute utilization graph.

Design a wireless test involving clients A and C that can reach access point B but cannot sense each other's transmissions. Provide a slot timeline and record overlapping transmissions. Randomized backoff reduces synchronized collisions but cannot abolish hidden-node effects. Compare with the pure ALOHA reference model and explain why its maximum throughput does not describe CSMA/CA. Introduce a third party on an overlapping channel and a client with a low modulation rate. Measure airtime rather than only transmitted bytes to understand why a slow client can disproportionately affect the shared medium.

The section ends with a failure review. An operator observes a successful ping but poor video quality. Possible causes include radio retransmissions, interference, queueing, upstream congestion, or application adaptation. Propose sequential measurements: signal and noise, retry counts, channel occupancy, wired uplink errors, RTT percentile under load, and throughput for a controlled stream. Reject interventions that do not follow evidence. Increasing access-point transmit power can worsen interference. Changing channels may help one room and harm another. The correct outcome is a documented diagnosis with before-and-after measurements, not a visually impressive configuration dashboard.

Engineering review and field notebook

A careful link performance study separates three clocks. The serialization clock counts bits put onto a physical interface. The propagation clock counts how long signal energy takes to travel through the medium. The queueing clock counts how long a frame waits behind earlier frames at a service point. Hardware and protocol processing introduce still more components. If one frame has 12,000 counted bits and a 10-Mbit/s serialization rate, the serialization contribution is 1.2 milliseconds; a slower device processor or extra wireless contention can increase the observed time without altering that arithmetic. Do not subtract a bandwidth-implied time from a measured RTT and call the remainder "propagation" unless all other contributions have been bounded.

Use a repeated-measurement worksheet. For each trial record sender location, receiver location, link medium, nominal interface speed, observed negotiated wireless rate where applicable, packet size, application payload size, retransmissions, error counters, and timing. Capture both idle and saturated operation. A queue that almost never forms under idle traffic can become dominant under bursts. A wireless interface's retransmission rate may increase with interference and mobility, while an Ethernet port's CRC errors suggest a different problem. An operator should know how to interpret an observation under the constraints of the measurement tool. Captures performed above a NIC with checksum or segmentation offload can appear unlike packets that traversed the wire.

Error handling provides another design lens. Link CRCs detect common accidental corruption but do not tell an operator which application data was correct after end-to-end storage. A wireless retry can save an application from a transient radio error but can increase latency; latency-sensitive applications may prefer occasional loss to unbounded retry delay. Ethernet switching provides simple point-to-point forwarding in ordinary modern fabrics, yet VLAN mistakes and Layer-2 loops can still affect many endpoints at once. Test protection against loops and unauthorized traffic in a bounded virtual lab. Never use an office production LAN to explore broadcast storms.

Suppose a proposed upgrade advertises double the radio PHY rate. The evaluation should estimate how much time is actually spent in useful data transmission. If airtime is dominated by contending clients and acknowledgments, double the coded rate may help less than expected; if wired uplink or application CPU is the bottleneck, it may not help at all. The correct procurement question is not "what is the largest rate printed on the box?" but "which observed bottleneck can the upgrade remove and what new bottleneck may appear afterward?"

Key technical vocabulary

frame. A bounded link-layer transmission unit containing payload and framing fields.

CRC. A polynomial-derived error-detection code, not a cryptographic authentication proof.

airtime. The amount of shared wireless medium time consumed by a transmission and its overhead.

hidden terminal. A transmitter undetectable by another contender that can still interfere at their receiver.

backoff. A deliberate randomized or scheduled delay before retrying medium access.

collision domain. Part of a shared medium where overlapping transmissions can interfere.

forwarding database. A switching table learned from source addresses and associated ingress ports.

VLAN. A virtual link-layer segmentation boundary, not automatically a complete security policy.

microburst. A short high-rate traffic episode obscured by longer measurement intervals.

PHY rate. Physical-layer signaling rate, distinct from successful application payload throughput.