Day 53: Data Link Protocols and Known Security Issues

Description

The main task of the data link layer is to transform a raw transmission facility into a line that appears free of undetected transmission errors. It does so by masking the real errors so the network layer does not see them. It accomplishes this task by having the sender break up the input data into data frames (typically a few hundred or a few thousand bytes) and transmit the frames sequentially. If the service is reliable, the receiver confirms correct receipt of each frame by sending back an acknowledgement frame. Another issue that arises in the data link layer (and most of the higher layers as well) is how to keep a fast transmitter from drowning a slow receiver in data. Some traffic regulation mechanism may be needed to let the transmitter know when the receiver can accept more data. Broadcast networks have an additional issue in the data link layer: how to control access to the shared channel. A special sublayer of the data link layer, the medium access control sublayer, deals with this problem.

Data Link Layer Duties

• It handles problems that occur as a result of bit transmission errors.
• It ensures data flows at a pace that doesn’t overwhelm sending and receiving devices.
• It permits the transmission of data to Layer 3, the network layer, where it is addressed and routed.

Data Link Layer — Physical Addressing

Physical addressing is different from network addressing. Network addresses differentiate between nodes or devices in a network, allowing traffic to be routed or switched through the network. In contrast, physical addressing identifies devices at the link-layer level, differentiating between individual devices on the same physical medium. The primary form of physical addressing is the media access control (MAC) address.

Data Link Layer — Network Topology

Network topology specifications identify how devices are linked in a network. Some media allow devices to be connected by a bus topology, while others require a ring topology. The bus topology is used by Ethernet technologies, which are supported on Juniper Networks devices.

Data Link Layer — Error Notification

The Data Link Layer provides error notifications that alert higher layer protocols that an error has occurred on the physical link. Examples of link-level errors include the loss of a signal, the loss of a clocking signal across serial connections, or the loss of the remote endpoint on a T1 or T3 link.

Data Link Layer — Frame Sequencing

The frame sequencing capabilities of the Data Link Layer allow frames that are transmitted out of sequence to be reordered on the receiving end of a transmission. The integrity of the packet can then be verified by means of the bits in the Layer 2 header, which is transmitted along with the data payload.

Data Link Layer — Flow Control

Flow control within the Data Link Layer allows receiving devices on a link to detect congestion and notify their upstream and downstream neighbors. The neighbour devices relay the congestion information to their higher layer protocols so that the flow of traffic can be altered or rerouted.

Data Link Layer — Data Link Sublayers

The Data Link Layer is divided into two sublayers: logical link control (LLC) and media access control (MAC). The LLC sublayer manages communications between devices over a single link of a network. This sublayer supports fields in link-layer frames that enable multiple higher layer protocols to share a single physical link.

The MAC sublayer governs protocol access to the physical network medium. Through the MAC addresses that are typically assigned to all ports on a device, multiple devices on the same physical link can uniquely identify one another at the Data Link Layer. MAC addresses are used in addition to the network addresses that are typically configured manually on ports within a network.

Data Link Layer — MAC Addressing

A MAC address is the serial number permanently stored in a device adapter to uniquely identify the device. MAC addresses operate at the Data Link Layer, while IP addresses operate at the Network Layer. The IP address of a device can change as the device is moved around a network to different IP subnets, but the MAC address remains the same, because it is physically tied to the device.

Within an IP network, devices match each MAC address to its corresponding configured IP address by means of the Address Resolution Protocol (ARP). ARP maintains a table with a mapping for each MAC address in the network.

Most Layer 2 networks use one of three primary numbering spaces — MAC-48, EUI-48 (extended unique identifier), and EUI-64 — which are all globally unique. MAC-48 and EUI-48 spaces each use 48-bit addresses, and EUI-64 spaces use a 64-bit addresses, but all three use the same numbering format. MAC-48 addresses identify network hardware, and EUI-48 addresses identify other devices and software.

The Ethernet and ATM technologies supported on devices use the MAC-48 address space. IPv6 uses the EUI-64 address space.

MAC-48 addresses are the most commonly used MAC addresses in most networks. These addresses are 12-digit hexadecimal numbers (48 bits in length) that typically appear in one of the following formats:

• MM:MM:MM:SS:SS:SS
• MM-MM-MM-SS-SS-SS

The first three octets (MM:MM:MM or MM-MM-MM) are the ID number of the hardware manufacturer. Manufacturer ID numbers are assigned by the Institute of Electrical and Electronics Engineers (IEEE). The last three octets (SS:SS:SSor SS-SS-SS) make up the serial number for the device, which is assigned by the manufacturer. For example, an Ethernet interface card might have a MAC address of 00:05:85:c1:a6:a0.

Protocol Data Unit

Frame

In computer networking, an Ethernet frame is a data link layer protocol data unit and uses the underlying Ethernet physical layer transport mechanisms. In other words, a data unit on an Ethernet link transports an Ethernet frame as its payload.

Main Security Issues

• MAC Flooding
• ARP Spoofing
• Port Hijacking
• DHCP Attacks
• Layer 2-based Broadcasting
• Denial of Service (DoS)
• MAC Cloning

Protocol Examples

• ARCnet
• ATM
• Cisco Discovery Protocol (CDP)
• Controller Area Network (CAN)
• Econet
• Ethernet
• Ethernet Automatic Protection Switching (EAPS)
• Fiber Distributed Data Interface (FDDI)
• Frame Relay
• High-Level Data Link Control (HDLC)
• IEEE 802.2 (provides LLC functions to IEEE 802 MAC layers)
• IEEE 802.11 wireless LAN
• I²C
• LattisNet
• Link Access Procedures, D channel (LAPD)
• Link Layer Discovery Protocol (LLDP)
• LocalTalk
• MIL-STD-1553
• Multiprotocol Label Switching (MPLS)
• Nortel Discovery Protocol (NDP)
• Point-to-Point Protocol (PPP)
• Profibus
• SpaceWire
• Serial Line Internet Protocol (SLIP) (obsolete)
• Split multi-link trunking (SMLT)
• IEEE 802.1aq — Shortest Path Bridging
• Spanning Tree Protocol
• StarLan
• Token ring
• Unidirectional Link Detection (UDLD)
• UNI/O
• 1-Wire
• and most forms of serial communication.

See also: Bit-sequence independence

Physical Layer OpSec

This is quite in-depth and will be posted in a special blog on securing later 2.