The Wire & The Signal

Opening Framing: Where Logical Networking Meets Physics

Weeks 1 and 2 established that networks are designed systems and that traffic can be analyzed in layers. Week 3 moves to the point where those abstractions meet physical reality. Packets do not travel through theory alone. They ride on copper, fiber, and radio, and every medium imposes constraints on distance, noise tolerance, speed, and failure behavior.

This week also introduces the Ethernet frame, which is one of the most important practical structures in networking. A host may think in IP addresses, but local delivery is still performed with frame logic, MAC addresses, and physical signaling. If a student cannot explain how a frame is built, what a switch learns, and why broadcasts behave differently from unicasts, later topics such as VLANs, ARP, routing, and Wireshark analysis become shallow memorization.

At bachelor level, Layer 1 and Layer 2 are not "just cables." They define the boundaries of local communication, the shape of fault domains, and the first evidence an engineer uses during an outage. A broken optic, a bad duplex negotiation, an overloaded broadcast domain, or a noisy RF environment can make higher-layer troubleshooting pointless until the lower-layer problem is understood first.

Learning Outcomes

• LO1: Compare copper, fiber, and wireless media using distance, speed, interference, and deployment trade-offs.
• LO2: Explain Ethernet framing, MAC addressing, and the difference between unicast, broadcast, and multicast behavior.
• LO3: Distinguish collision domains from broadcast domains and relate them to hubs, switches, routers, and VLANs.
• LO4: Verify Layer 1 and Layer 2 behavior using interface checks, MAC tables, and Wireshark evidence.
• LO5: Diagnose common physical and data-link failures such as cabling faults, duplex issues, wrong transceivers, and broadcast noise.

Key insight: higher-layer communication only looks stable when the local medium, frame handling, and domain boundaries are engineered correctly.

1) Physical Media: Copper, Fiber, and Wireless are Different Engineering Choices

The first design question is not "Which cable is popular?" but "What operational constraints does this link need to survive?" A short office access link, a data-center uplink, and a campus building interconnect do not have the same requirements. Medium choice affects maximum distance, immunity to interference, cost, ease of installation, and long-term scalability.

An experienced engineer thinks in constraints. Copper is excellent inside offices because runs are short and structured cabling is cheap. Fiber dominates campus and high-speed uplinks because electrical interference and distance ceilings become unacceptable at scale. Wireless exists because user mobility matters, but that mobility comes with the cost of shared airtime, RF contention, and careful channel planning.

2) Copper Ethernet: Distance, EMI, Duplex, and Autonegotiation

Twisted-pair Ethernet remains the default access-layer medium in most buildings. The twisting pattern reduces electromagnetic interference, and standards such as Cat 5e, Cat 6, and Cat 6A specify performance targets for bandwidth, crosstalk, and installation quality.

Copper networks also force engineers to care about duplex and negotiation behavior. In modern switched Ethernet, links are normally full duplex, which means send and receive can happen at the same time. That largely eliminates the old collision behavior associated with shared half-duplex Ethernet. However, a duplex mismatch can still create severe packet loss, late collisions, low throughput, and unstable application behavior even when the link appears physically up.

Physical-layer checks engineers care about

- Is the link up at all?
- Did speed and duplex negotiate as expected?
- Is the cable type and termination appropriate?
- Are interface counters showing errors, drops, or CRC problems?
- Is this environment electrically noisy?

3) Fiber and Wireless: Long Reach vs Shared Airtime

Fiber optic networking uses light rather than electrical signals. That gives it two major advantages: very high throughput and resistance to EMI. This is why fiber is preferred for backbones, uplinks, and building-to-building links. The main operational trade-off is that fiber requires the correct optic, connector, and mode choice.

Wireless solves a different problem: endpoint mobility. The medium is not a dedicated wire but shared radio spectrum. That means client experience is shaped by contention, interference, channel overlap, signal strength, and the number of active stations. Wired engineers often underestimate this. A wireless problem is not just "a cable you cannot see." It is a dynamic shared-medium problem.

In both fiber and wireless, the recurring engineering theme is the same: matching the medium to the requirement. If the requirement is distance, stability, and clean throughput, fiber often wins. If the requirement is mobility, wireless is necessary. If the requirement is cheap, predictable desktop access, copper remains hard to beat.

4) Ethernet Framing and MAC Addressing: How Local Delivery Actually Works

At Layer 2, devices on the same local segment do not forward raw IP packets directly. They forward frames. An Ethernet frame carries local delivery information, including source and destination MAC addresses, a type field describing the upper-layer payload, the data itself, and a frame check sequence used for error detection on the link.

Local-delivery logic

1. Host decides the destination is local or remote
2. Host learns the correct local MAC address
3. Host builds an Ethernet frame
4. Switch forwards based on destination MAC
5. Receiving NIC accepts or drops the frame

A MAC address is a local-link identifier, not a global path identifier. That is why MAC addresses change hop by hop across routed networks while IP addresses generally stay constant end to end. Switches care about MAC addresses because they are making local forwarding decisions. Routers care about IP addresses because they are making inter-network forwarding decisions.

5) Collision Domains vs Broadcast Domains

These two ideas are often memorized badly, so they need precise treatment. A collision domain is the part of the network where simultaneous transmissions can interfere with each other on the same shared medium. A broadcast domain is the set of devices that will receive a Layer 2 broadcast frame such as ff:ff:ff:ff:ff:ff.

In modern full-duplex switched Ethernet, real collisions are rare because each port is its own separate segment. The concept still matters historically and conceptually, especially when explaining why hubs became obsolete and why old half-duplex behavior imposed performance penalties. Broadcast domains, by contrast, remain very relevant. Broadcast traffic still reaches every device in the VLAN, which is why engineers use routers and VLAN boundaries to contain unnecessary Layer 2 noise.

Simple counting example

4 PCs connected to 1 switch in 1 VLAN:
- Collision domains: 4 active access links
- Broadcast domains: 1

4 PCs split across 2 VLANs on the same switch:
- Collision domains: still 4 active access links
- Broadcast domains: 2

Switch connected to router with 2 interfaces serving 2 subnets:
- Router breaks the broadcast domains between those networks

6) Verification: What Good Layer 1 and Layer 2 Evidence Looks Like

Foundational networking is not complete until students know how to prove local behavior with evidence. A frame-level problem rarely announces itself cleanly. The job is to correlate interface state, counters, local addressing, MAC learning, and packet capture observations.

Useful verification commands and tools

Cisco IOS:
show interfaces status
show interfaces
show mac address-table

Linux:
ip link
ip addr
ip neigh
ethtool eth0

Windows:
ipconfig /all
arp -a

Analysis tools:
Wireshark
Packet Tracer Simulation Mode

Useful Wireshark filters for this week

eth
arp
icmp
eth.addr == 00:11:22:33:44:55
eth.dst == ff:ff:ff:ff:ff:ff

The last filter is especially useful because it isolates Ethernet broadcasts. Students should see directly that ARP requests are often broadcast at Layer 2 even though the later communication becomes unicast once the target MAC address is known.

7) Failure Modes: Where Layer 1 and Layer 2 Problems Come From

Lower-layer failures are dangerous because higher-layer symptoms often look misleading. Users report "the Internet is slow" or "the app is broken," but the root cause may be a marginal fiber optic, a duplex mismatch, a wrong SFP module, or excessive broadcast behavior in the local VLAN.

1. Confirm the physical medium and interface state before changing higher-layer settings.
2. Check whether the switch is learning MAC addresses where you expect.
3. Confirm whether the traffic in question is broadcast, multicast, or unicast.
4. Use a capture to see whether the local frame behavior matches your topology assumption.

Key insight: a clean IP configuration does not rescue a damaged physical path or a broken local broadcast domain.

Real-World Context: Media Choice and Domain Design Shape the Whole Network

Enterprise networks are full of deliberate Layer 1 and Layer 2 judgments. Access floors usually run copper to user devices because it is practical and economical. Distribution and core links often run fiber because bandwidth, stability, and distance requirements exceed what copper should carry. Wireless overlays exist because users move, not because radio is inherently simpler than cable.

Broadcast-domain design also becomes critical as organizations scale. A flat Layer 2 network may appear simple early on, but it increases ARP traffic, failure blast radius, and troubleshooting ambiguity. Later in the degree, VLANs and routing are introduced partly to control this local-domain sprawl. Week 3 is therefore not isolated from later routing work. It explains why those boundaries are needed in the first place.

Guided Lab: Analyze Ethernet Frames in Wireshark

Goal: Capture local traffic and prove the difference between broadcast and unicast Ethernet behavior using real frame evidence.

Step 1: Prepare the capture environment

1. Open Wireshark on a host with active network connectivity.
2. Select the primary network interface that is carrying your traffic.
3. Start a capture with no display filter applied yet.

Step 2: Generate simple local traffic

1. Open a terminal or command prompt.
2. Run a ping to the default gateway or another reachable local device.
3. If possible, clear or refresh the ARP cache first so an ARP exchange appears in the capture.

Step 3: Isolate Ethernet and ARP behavior

1. Apply the display filter eth and confirm you are seeing Ethernet frames.
2. Apply the filter arp and identify an ARP request.
3. Record the destination MAC address of the ARP request and explain why it is a broadcast.
4. Find the ARP reply and record how the destination MAC changes from broadcast to unicast behavior.

Step 4: Examine an ICMP frame

1. Apply the display filter icmp.
2. Select an ICMP echo request frame generated by your ping.
3. Record the source MAC, destination MAC, source IP, and destination IP values.
4. Identify the EtherType field and the Layer 3 payload carried inside the frame.

Step 5: Interpret the result

1. Explain why the initial ARP request was broadcast but the later ICMP traffic was unicast.
2. State whether the local switch would flood or selectively forward each frame type.
3. Write one paragraph explaining what a switch can learn from the source MAC field.

Lab reflection (mandatory)

1. What evidence in the capture proved the difference between local discovery and normal unicast forwarding?
2. Why would a large broadcast domain make this kind of traffic noisier at scale?
3. What did Wireshark show clearly, and what parts of the frame may have been hidden by the NIC hardware?

Week 3 Outcome Check

By the end of this week, you should be able to:

• Choose an appropriate medium by thinking about distance, interference, cost, and operational need
• Explain the job of the Ethernet frame and the local role of MAC addresses
• Differentiate collision domains from broadcast domains without relying on vague definitions
• Use interface data, MAC tables, and captures as evidence of lower-layer behavior
• Recognize common Layer 1 and Layer 2 failures before blaming higher layers

Next week builds on this by moving into binary foundations and IPv4 addressing logic.

Hands-On Labs

Use the activities below to turn media facts and frame theory into operational reasoning.

Checkpoint Questions

1. Why is medium selection a design decision rather than a hardware preference?
2. What practical differences make fiber more suitable than copper for many uplinks and backbone paths?
3. What does an Ethernet frame add that an IP packet alone does not provide?
4. Why does a switch learn from source MAC addresses rather than destination MAC addresses?
5. What is the difference between a collision domain and a broadcast domain?
6. Why are collisions less relevant in modern full-duplex switched Ethernet but broadcast domains still operationally important?
7. Which Wireshark filter would you use to isolate Ethernet broadcasts, and what would you expect to see?

Weekly Reflection

Reflection prompt (200-300 words):

This week connected physical media decisions to Ethernet behavior and local network boundaries. Reflect on how much of networking stability depends on lower-layer design.

• Why is it dangerous to think of Layer 1 and Layer 2 as "just hardware"?
• How did frame analysis change the way you think about local communication?
• Why do broadcast-domain boundaries become more important as a network grows?
• If you were designing a campus network, where would you insist on fiber, and where would you still use copper or wireless?

A strong reflection should connect physical constraints, local forwarding, and design trade-offs.

Recommended References

• Wireshark User's Guide: official documentation for capture workflow, packet list interpretation, and protocol inspection.
• Wireshark Display Filter Reference: Ethernet fields for practical Ethernet filter syntax during the lab.
• RFC 894: A Standard for the Transmission of IP Datagrams over Ethernet Networks for the classic relationship between IP and Ethernet.
• Cisco Networking Academy: Networking Basics for structured foundational coverage of Ethernet, media, and local-area design.
• Cisco RF Management Reference: wireless RF management practices for the real operational problems created by shared spectrum and interference.
• Cisco Ethernet Switching Overview: What Is Network Switching? for switching behavior, forwarding logic, and modern Ethernet context.

Read the references with a purpose: understand what the medium carries, what the frame adds, and what evidence proves local forwarding is behaving the way you think it is.

Week 03 Quiz

Test your understanding of physical media, Ethernet frames, MAC logic, and domain boundaries.