The Data Link Layer (Layer 2) governs the physical transfer of frames across local network media. Many critical internal network compromises occur at Layer 2 because legacy protocols lack cryptographic authentication.
1. The Ethernet II Frame Structure
Standard Ethernet communication uses the Ethernet II (DIX) frame format. Every frame transmitted on a local segment adheres to this layout:
- Preamble & SFD (Start Frame Delimiter): Alternating
10101010pattern ending in10101011to synchronize hardware clocks. - EtherType: Indicates the encapsulated Layer 3 protocol (e.g.,
0x0800= IPv4,0x86DD= IPv6,0x0806= ARP,0x8100= 802.1Q VLAN Tag). - Payload: The encapsulated packet. Minimum size is 46 bytes (padded if smaller); maximum transmission unit (MTU) is 1500 bytes.
- FCS (Frame Check Sequence): 32-bit Cyclic Redundancy Check (CRC) to detect bit corruption during transit. Frames failing the CRC check are silently discarded.
2. MAC Addressing Mechanics
A Media Access Control (MAC) address is a 48-bit (6-byte) physical identifier assigned to a Network Interface Card (NIC), usually written in hexadecimal (e.g., 00:1A:2B:3C:4D:5E).
- OUI (Organizationally Unique Identifier): First 24 bits (3 bytes) assigned to the hardware vendor (e.g., Cisco, Intel, Apple) by the IEEE.
- NIC Specific Identifier: Last 24 bits (3 bytes) uniquely serialized by the vendor.
- Broadcast Address:
FF:FF:FF:FF:FF:FF(all 48 bits set to 1) processed by all endpoints in the local broadcast domain.
3. Address Resolution Protocol (ARP) & Poisoning
Because IP addresses operate at Layer 3 and Ethernet switches operate at Layer 2, hosts must map IP addresses to MAC addresses using ARP (RFC 826).
# 1. Host A (192.168.1.10) wants to send a packet to Host B (192.168.1.20)
# Host A sends an ARP Request (Broadcast):
"Who has 192.168.1.20? Tell 192.168.1.10 (MAC: aa:aa:aa:11:11:11)" -> Dst MAC: FF:FF:FF:FF:FF:FF
# 2. Host B receives the broadcast and replies (Unicast):
"192.168.1.20 is at bb:bb:bb:22:22:22" -> Dst MAC: aa:aa:aa:11:11:11
# 3. Host A stores this in its local ARP Table:
arp -a
# 192.168.1.20 bb-bb-bb-22-22-22 dynamicVulnerability: ARP is completely stateless and unauthenticated. A host will happily update its ARP cache upon receiving an unsolicited (Gratuitous) ARP Reply.
Attack: An attacker (Attacker MAC: cc:cc:cc:33:33:33) floods continuous forged ARP replies to both Victim (192.168.1.10) and the Default Gateway (192.168.1.1):
- Tells Victim: "192.168.1.1 is at cc:cc:cc:33:33:33"
- Tells Gateway: "192.168.1.10 is at cc:cc:cc:33:33:33"
All traffic between the victim and the Internet now routes through the attacker's machine, allowing interception, modification, or session hijacking.
4. Layer 2 Switch Attacks & Hardening
Exploitations
- MAC Flooding: Flooding the switch's CAM table with thousands of bogus source MACs, exhausting memory and forcing the switch into "fail-open" hub mode.
- VLAN Hopping: Exploiting dynamic trunking protocol (DTP) switch spoofing or double 802.1Q tagging to inject packets into unauthorized VLANs.
- Rogue DHCP Server: Providing rogue default gateways and DNS servers to client workstations.
- STP Manipulation: Injecting forged BPDUs to force the attacker's node as the STP Root Bridge.
Switch Hardening
- Port Security: Restricting the number of MAC addresses learned per physical port; automatically shuts down offending ports.
- DHCP Snooping: Designates trusted vs. untrusted ports; builds a validated IP-to-MAC-to-Port binding database.
- Dynamic ARP Inspection (DAI): Validates ARP packets against the DHCP Snooping database to drop spoofed ARP replies.
- BPDU Guard & Root Guard: Disables ports receiving unauthorized STP BPDUs to protect topology root integrity.