What you will learn on this page

The Data Link layer corresponds to point-to-point connections, as was traditionally found in baseband video and audio systems. Today, these point-to-point connections are typically between network switching devices. This is different from the myriad of boxes used before 2110.

How is the Data Link layer differentiated today from that layer found in traditional OSI stacks? It supports higher bandwidth options of 10, 25, or 100G. It also needs switches that have low jitter, are non-blocking, support multicast and that can also ensure high Quality of Service (QoS). The switches must also support redundancy. When it comes to creating a 2110 compatible data link layer; "it's all about the switches."

Layer 2 (the Data Link layer) is the lowest OSI layer where data is formally framed, often described as being placed inside a “wrapper.” Conceptually, this wrapper can be thought of as an envelope around the payload. When a frame arrives at a network interface, the Ethernet (Layer 2) header is processed first. The information in this header—such as source and destination MAC addresses, VLAN tags, and frame type—tells the receiving hardware where the frame came from, who it is intended for, and how the payload should be handled.

Not to get too far ahead of ourselves, but to start off with a good understanding of what comprises the Ethernet packet payload, let's look ahead a bit at what the Ethernet layer is transporting in a typical 2110 scanerio.

To be clear, the envelope graphic shown above (left) is conceptually useful but physically misleading. In many layered diagrams, the upper-layer “envelopes” appear smaller, even though in a typical SMPTE 2110 packet the RTP payload accounts for the vast majority of the final Ethernet frame. While RTP is often grouped near the application layer for teaching purposes, it sits above UDP and carries the media essence itself. In a more physically accurate representation, the RTP/media payload would be very large, with each lower-layer header—UDP, IP, and Ethernet—adding only a small incremental amount of overhead. We will see this relationship more clearly next when we examine actual packet sizes.

Ethernet Frames

Ethernet frames have a maximum payload (MTU) of 1500 bytes for standard configurations, but the full frame size is up to 1518 bytes when including the header and trailer (excluding the 7-byte preamble, 1-byte Start Frame Delimiter, and 12-byte interframe gap, which are handled at the physical layer and not counted in the MTU). The Ethernet header is always 14 bytes (6-byte destination MAC + 6-byte source MAC + 2-byte EtherType/Length), and the trailer is always 4 bytes (Frame Check Sequence/FCS), totaling 18 bytes of fixed overhead per frame. This structure doesn't change—it's standard per IEEE 802.3.

For carrying HD video (e.g., in SMPTE ST 2110 scenarios, which uses RTP over UDP/IP/Ethernet for uncompressed or lightly compressed streams like 1080p60), RTP is typically paired with UDP (not TCP, due to UDP's low-latency, connectionless nature). Here's a breakdown of a typical packet:

• Total Ethernet Payload (MTU): 1500 bytes max.
• IP Header (IPv4, no options): 20 bytes – Handles routing and addressing.
• UDP Header: 8 bytes – Provides port multiplexing and basic checksum.
• RTP Header (basic, no extensions or CSRC): 12 bytes – Adds timestamps, sequence numbers, and payload type for real-time media synchronization/sequencing.
• Total Overhead Above Ethernet: 20 (IP) + 8 (UDP) + 12 (RTP) = 40 bytes.
• Actual Video Data per Packet: Up to 1500 - 40 = 1460 bytes (though often less, e.g., ~1370 bytes in ST 2110 to allow for traffic shaping and avoid fragmentation).

In real ST 2110 HD video deployments:

• Packets are sized to fit video essence chunks (e.g., parts of a scan line or samples) efficiently, often around 1400 bytes total payload to leave headroom.
• Multicast UDP is used, and IPv6 (40-byte header) may replace IPv4 in modern setups, increasing overhead to 60 bytes total (IP + UDP + RTP).
• No TCP – RTP avoids it because TCP's retransmissions would introduce unacceptable latency for live video.

A major difference between a typical business website and a professional SMPTE ST 2110 media facility is optional use of "jumbo" frames. But these frames are not required by the ST 2110 standards. We will see that there are pros and cons to their use.

Why are jumbo frames used?

• Reduced overhead: With a standard 1500-byte MTU (Maximum Transmission Unit), sending large data (e.g., uncompressed 4K video at ~12 Gbps) requires many more packets → more headers (Ethernet + IP + UDP + RTP) per second.
• Lower CPU load: Fewer packets mean fewer interrupts and less header processing on NICs, switches, and endpoints.
• Higher efficiency: Overhead drops dramatically (e.g., from ~3–5% to <0.5% on large payloads).

Jumbo frames are essential for high-bandwidth applications like SMPTE ST 2110, where HD/4K/8K uncompressed streams would otherwise fragment excessively or overwhelm the network stack. In practice, almost every professional 2110 deployment uses jumbo frames (commonly 9000 bytes) network-wide.

• Ensures maximum interoperability across mixed-vendor gear, including consumer/enterprise switches that may not handle jumbo frames well.
• Avoids fragmentation issues and simplifies troubleshooting.
• Keeps latency low and packet processing predictable (critical for real-time media).
• The overhead (Ethernet/IP/UDP/RTP headers) is only ~1–3% for large payloads, so the efficiency gain from jumbo frames is minor compared to the risks.

How Jumbo Frames Affect the Data-Link Layer (Layer 2)

• The Data-Link layer (Ethernet) is directly responsible for framing, so it must support and transport the larger frame size.
• Switches and NICs must be explicitly configured to accept frames >1518 bytes (standard max) up to the jumbo limit (e.g., mtu 9216 on interfaces).
• All devices in the path (NIC → switch → NIC) must agree on the same jumbo MTU — if any link enforces 1500 bytes, the frame is dropped (giant frames error).
• No change to the Ethernet header/trailer structure (still 18 bytes total), but the payload field is simply allowed to be much larger.
• Layer 2 multicast/IGMP snooping and QoS still apply normally — jumbo frames don't alter MAC addressing or collision domain behavior.

Bottom line: Jumbo frames are a Layer 2 configuration change that dramatically improves efficiency for high-throughput, low-latency media like 2110, but they require consistent end-to-end support across the entire switched network. Misconfiguration is one of the most common reasons 2110 streams fail silently or fragment.

Ethernet Mechanics

Let's now look at what Ethernet is and how it works. It is a four-step process. Ethernet uses a process called CSMA/CD (Carrier Sense, Multiple Access/Collision Detection).
Broken down this means:

1. Carrier Sense — A node listens to check if the bus (shared medium) is idle before transmitting.
2. Multiple Access — Any node can attempt to use the medium.
3. Collision Detection — While transmitting, the node continues listening. If it detects a collision (another node transmitting simultaneously), the frame is corrupted.
4. Collision Handling — All nodes stop transmitting, send a jam signal, and wait a random backoff time (using binary exponential backoff) before retrying. After 16 consecutive collisions, the Data-Link layer reports an error and discards the frame.

CSMA/CD is simple but collision-prone, so real-world Ethernet networks rarely achieve full advertised speeds (especially in shared/half-duplex environments). Modern switched full-duplex Ethernet eliminates collisions.

A Collision Domain (CD) is a network segment where all nodes receive traffic from any other node in that segment (e.g., everything on a hub or shared coax). In early large collision domains (before widespread switches), the 5-4-3 Rule limited network size to prevent undetected collisions due to propagation delay:

No more than 5 segments connected by 4 repeaters. Only 3 segments can be populated (have nodes attached); the other 2 are unpopulated link segments between repeaters.

This rule applied mainly to 10 Mbps Ethernet (10BASE5 thicknet and 10BASE2 thinnet) in tree/bus topologies. It is now obsolete in switched networks, where each switch port creates a separate collision domain.

A NIC sends Ethernet frames (based on IEEE 802.3) consisting of 26 bytes of overhead, surround the payload data consisting of the following:

Note: The actual preamble is 7 bytes, + a Start Frame Delimiter (SFD) (1 byte): For clock synchronization (not part of the frame proper).

The frame "envelops" upper-layer data (e.g., IP packets) without knowing the content.

Frame Reception Process:

1. Check CRC/FCS; discard if invalid.
2. Check destination MAC; if match (or broadcast), process.
3. Strip Ethernet header and pass payload to higher layer (e.g., check EtherType for IP).
4. Discard frame.

A MAC address consists of six bytes (48 bits).

1. The first bit is a flag that indicates whether the MAC address is a broadcast or multicast address.
2. The second bit is a flag indicating whether this a locally or globally administered MAC address.
3. The next 22 bits are uniquely assigned to particular vendors.
4. The last 24 bits indicate a particular NIC card.

A Data-Link broadcast Layer 2 broadcast is indicated when all bits in the destination address are high, or FF:FF:FF:FF:FF:FF. This means that this packet is intended for all nodes.

What happens when a node receives an Ethernet frame?

1. CRC is checked and if correct,
2. The destination is checked—if it is a match,
3. The outer Ethernet frame is discarded and handed to the correct protocol above it. In other words, the outer enelope is thrown away.
4. The Ethernet-type field is checked on the inner envelope, to see what protocol was used at the network layer.

Often a network consists ofmultiple local LANs. The simplest way to do this historically was with a Bridge. They were first used to break up collision domains (CDs). Remember that a CD usually spans all nodes connected to a hub, or in early networks, all nodes connected together on the same length of tapped coax with AUIs.

Bridges and Hubs

Historically, multiple local LANs were connected via bridges (early devices to separate collision domains). Bridges learn MAC addresses, filter traffic, forward broadcasts, and use Spanning Tree Protocol (STP) to prevent loops (bridging loops cause broadcast storms). Bridges do not modify frames.

Hubs repeat every frame to all ports (one large CD). Switches can replace hubs directly, providing dedicated bandwidth (only source/destination in same CD).

If a bridge is designed to connect different protocols, such as Ethernet to Token Ring, those are referred to as Translational bridges. You won’t find many of these anymore. Bridges always forward broadcast traffic, which is traffic intended for all nodes. Network devices use broadcast addresses to discover information about a network, such as when looking for a resource on the network.

Bridges can’t handle multiple routes between two different nodes. They get confused as to which collision domains the two nodes are actually in. This is known as a bridging loop. Most bridges use a technique called the Spanning Tree Algorithm (more on this in a bit) to detect bridging loops and automatically disable bridge paths that form loops.

Switch

Switches are multiport hardware-accelerated bridges (ASIC-based). They break collision domains (each port is its own CD), learn MAC addresses, filter traffic, and prevent loops via STP. Switches are faster than routers (Layer 2 vs. Layer 3). Modern networks are flat (single broadcast domain via switches), with collapsed backbones replaced by distributed switching.

Spanning Tree Protocol (STP)

As we have mentioned, you can confuse bridges and switches if there are multiple paths between network segments. To combat this situation upon wakeup, bridges and switches invoke Spanning Tree Protocol (STP) where each port on either device either allows traffic forwarding to other segments, or the port is set to block traffic between two segments.

To put this in a simpler light, the switches get together and elect a 'Root Bridge' — basically the boss switch. The one with the lowest Bridge ID wins (that's usually the default priority of 32768 plus its MAC address — lower MAC breaks ties).

Next, on every network segment (link between switches), they pick one switch to be in charge of that segment — the one with the best path to the Root gets to be the Designated Port for that link. Now, here's the important part: any ports that would create a loop? STP just says 'nope' and blocks them. They sit there quietly, ready to jump in if needed, but not forwarding traffic right now.

Each port settles into either a forwarding or a blocking state, this process is known as convergence. When all ports on bridges and switches have transitioned to either forwarding or blocking modes, the LAN is said to be converged. The goal is to leave only one path between network segments. During the convergence phase, no data will be forwarded. Convergence determines that all ports are either in the forwarding or blocking mode. STP is a data link protocol. From here on out we will concentrate on switches.

When convergence is complete, every port on every switch will be left in one of three states. It will be a root port, a designated port, or a blocked port. A root port is the port looking at a network segment that provides the shortest path back to the designated root switch. A designated port is a port “designated” to communicate with a network segment. If a switch is surrounded by four network segments, then hree ports will be “designated ports” (DP), and one will be the “root port” (RP), connected to the network segment leading back to the root switch. A “blocked port” (BP) will not communicate with the network segment it is connected to, as another port on a different switch is handling that task. This is how multiple paths between nodes are prevented. Multiple paths between nodes can lead to “broadcast storms” where multiple switch ports are all trying to push the same data to a single node. This can quickly avalanche as responses from the destination are multiplied on the return path.

If a port fails on a switch, all the switches will re-enter the convergence mode and a port that was blocked from talking to a segment will now be the “designated” port for that segment. Often, this causes a ripple effect where a number of ports will change between the three states.

To prepare a group of network segments to be tied together by switches, the IT administrator designates Bridge IDs (BIDs). Switches still use the BID term for each switch. Whatever switch they want to designate as the root, where all other switches point to this switch, is assigned the lowest BID value. This BID value is combined with the switch port’s MAC. The BID default value is 32768, and can only be changed in increments of 4096. The switch assigned the lowest BID will be the root switch when convergence is completed. BPDU packets contain BID fields.

If a switch receives a data packet and it can't determine the output port to use, it broadcasts the frame out of all non-blocked ports except the port on which the frame was received. Once a switch determines which port to use for a particular destination, it puts that information into a table. The table is expanded as new destinations are encountered. This is called transparent bridging. When convergence occurs, those tables are erased and the process of discovery starts anew. Temporarily slow network traffic might be a symptom that a network failure or change has forced your network to re-converge.

If a node on a switch cannot communicate with another one connected to the same switch, the problem is most likely that either STP shut down one of the two ports, or that VLAN membership for the port is configured incorrectly. We will look at VLANS shortly.

So switches are either forwarding, flooding out all ports, or dropping received frames. No notification to the sender is done regardless of the switch’s decision. As we will see later, lost data packets are handled at a higher layer. So to recap; the switch has three functions—Address learning, filtering, and loop avoidance. You can set switch ports to authenticate authorized MAC addresses by keeping a list generated by the administrator that is not eliminated during a re-convergence.

It should be stressed that while switches recognize frames and pay attention to source and destination MAC addresses, as well as to the ports that Ethernet frames are received and sent on, hubs do not. Hubs dutifully relay every frame received to every other Hub port. A network switch can usually simply replace a hub with no other changes. The most cost-effective way to start implementing switches is to keep the hubs, but add a central switch that all the hubs connect to. The other advantage is that you can connect central servers to the switch so that they only receive traffic intended for them. Each node connected to its own dedicated switch port means that only two nodes are in the same collision domain. This means more bandwidth and thus throughput.

While we stated earlier that a switch connects one port to only one other port at a time, there is an exception to this. Port mirroring is used on a switch to send a copy of packets seen on one port to another port. This is also called Switch Port Analyzer (SPAN) or Port Spanning. It can cause a lot of overhead on the switch.

Ports also end up as access, trunk, and hybrid on switches. These concepts are key in VLAN networking, but they vary a bit depending on the vendor. While we will look at that next lets talk briefly about them now.

Access ports belongs to exactly one VLAN. Perfect for connecting computers, printers, and servers. While a Trunk port carries traffic for multiple VLANs over one link (classic inter-switch connection). A Hybrid Port is currently a single vender mode from Huawei. You can configure multiple VLANs to exit. Great for mixed scenarios, or weird legacy setups.

To add some confusion to switches, while they are generally found at the layer 2/Data-Link level, there are devices also called switches found at higher OSI layers. Some switches have ambitions of working at the next layer up, level 3/Network, and provide some rudimentary router capabilities. There are also switches that operate on layers 4–7. These provide content switching that allows load balancing. This is useful for HTTP, HTTPs, VPN traffic, especially when converging on servers and other resources.