Complete Protocols Master Part 2: Physical & Data Link Layers

Physical Layer (Layer 1): Bits on the Wire

The Physical Layer is responsible for the actual transmission of raw bits over a physical medium. It defines electrical, optical, and radio specifications for data transmission.

Transmission Media Types

Signaling and Encoding

The Physical Layer must convert digital bits (0s and 1s) into signals that can travel through the medium:

# Visualizing Manchester Encoding
def manchester_encode(data_bits):
    """
    Manchester encoding: Each bit is represented by a transition
    - 0: High-to-Low transition (falling edge)
    - 1: Low-to-High transition (rising edge)
    """
    encoded = []
    for bit in data_bits:
        if bit == '1':
            encoded.extend([0, 1])  # Low-to-High transition
        else:  # bit == '0'
            encoded.extend([1, 0])  # High-to-Low transition
    return encoded

# Example: Encode "1010"
data = "1010"
encoded = manchester_encode(data)

print(f"Original bits: {data}")
print(f"Manchester:    {encoded}")
print(f"Signal length: {len(data)} bits -> {len(encoded)} symbols (2x)")

# Visual representation
print("\nVisual encoding:")
for i, bit in enumerate(data):
    symbols = encoded[i*2:i*2+2]
    if bit == '1':
        print(f"Bit {bit}: _/‾ (Low-to-High)")
    else:
        print(f"Bit {bit}: ‾\_ (High-to-Low)")

Physical Layer Devices

Data Link Layer (Layer 2): Frames & Addressing

The Data Link Layer provides node-to-node data transfer—delivering frames between two directly connected nodes. It handles physical addressing (MAC), error detection, and media access control.

MAC Addressing: The Hardware Identity

Every network interface has a unique MAC (Media Access Control) address—a 48-bit (6-byte) hardware address burned into the NIC.

MAC Address: 00:1A:2B:3C:4D:5E
             ├─────┤├─────┤
             OUI     NIC-Specific

OUI (Organizationally Unique Identifier):
  - First 3 bytes (24 bits)
  - Assigned by IEEE to manufacturers
  - Identifies the vendor (Intel, Cisco, Apple, etc.)

NIC-Specific:
  - Last 3 bytes (24 bits)
  - Assigned by manufacturer
  - Unique to each network interface

Total combinations: 2^48 = 281 trillion unique addresses

# Working with MAC addresses in Python
import re
import random

def validate_mac(mac_address):
    """Validate MAC address format"""
    # Common formats: 00:1A:2B:3C:4D:5E, 00-1A-2B-3C-4D-5E, 001A.2B3C.4D5E
    patterns = [
        r'^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$',  # Colon separated
        r'^([0-9A-Fa-f]{2}-){5}[0-9A-Fa-f]{2}$',  # Dash separated
        r'^([0-9A-Fa-f]{4}\.){2}[0-9A-Fa-f]{4}$'  # Cisco format
    ]
    return any(re.match(pattern, mac_address) for pattern in patterns)

def normalize_mac(mac_address):
    """Convert any MAC format to standard colon format"""
    # Remove all separators
    clean = re.sub(r'[:\-\.]', '', mac_address)
    # Insert colons
    return ':'.join(clean[i:i+2] for i in range(0, 12, 2)).upper()

def get_oui_info(mac_address):
    """Extract OUI (vendor) portion"""
    normalized = normalize_mac(mac_address)
    oui = normalized[:8]  # First 8 chars (including colons)
    
    # Common OUI examples (in reality, use IEEE database)
    oui_database = {
        '00:1A:2B': 'Ayecom Technology',
        'FC:FB:FB': 'Cisco Systems',
        '00:50:56': 'VMware',
        'DC:A6:32': 'Raspberry Pi',
        '3C:22:FB': 'Apple',
        'B8:27:EB': 'Raspberry Pi Foundation',
    }
    return oui_database.get(oui, 'Unknown Vendor')

def generate_random_mac():
    """Generate a random locally administered MAC"""
    # Set locally administered bit (2nd least significant bit of first byte)
    first_byte = random.randint(0, 255) | 0x02  # Set LA bit
    first_byte &= 0xFE  # Clear multicast bit
    
    remaining = [random.randint(0, 255) for _ in range(5)]
    mac_bytes = [first_byte] + remaining
    
    return ':'.join(f'{b:02X}' for b in mac_bytes)

# Examples
macs = ['00:1A:2B:3C:4D:5E', '00-50-56-C0-00-08', 'FCFB.FB12.3456']

for mac in macs:
    print(f"MAC: {mac}")
    print(f"  Valid: {validate_mac(mac)}")
    print(f"  Normalized: {normalize_mac(mac)}")
    print()

print(f"Random locally administered MAC: {generate_random_mac()}")

Ethernet Frame Structure

Ethernet is the dominant Layer 2 protocol for wired LANs. Let's examine the frame structure:

┌──────────┬──────────┬──────────┬──────────┬──────────────┬─────┐
│ Preamble │   SFD    │   Dest   │  Source  │  EtherType   │     │
│ (7 bytes)│ (1 byte) │   MAC    │   MAC    │  (2 bytes)   │     │
│          │          │ (6 bytes)│ (6 bytes)│              │     │
└──────────┴──────────┴──────────┴──────────┴──────────────┘     │
                                                                  │
┌─────────────────────────────────────────────────────────────────┤
│                          Payload                                │
│                    (46-1500 bytes)                              │
├─────────────────────────────────────────────────────────────────┤
│                        FCS (4 bytes)                            │
│                 Frame Check Sequence (CRC-32)                   │
└─────────────────────────────────────────────────────────────────┘

Common EtherType Values:
  0x0800 = IPv4
  0x0806 = ARP
  0x86DD = IPv6
  0x8100 = 802.1Q VLAN Tagged Frame
  0x8847 = MPLS (Unicast)

# Parsing an Ethernet frame in Python
import struct

def parse_ethernet_frame(raw_data):
    """Parse Ethernet II frame header"""
    # First 14 bytes are the Ethernet header
    # 6 bytes dest MAC + 6 bytes src MAC + 2 bytes EtherType
    
    dest_mac = raw_data[0:6]
    src_mac = raw_data[6:12]
    ethertype = struct.unpack('!H', raw_data[12:14])[0]
    payload = raw_data[14:]
    
    return {
        'dest_mac': format_mac(dest_mac),
        'src_mac': format_mac(src_mac),
        'ethertype': hex(ethertype),
        'ethertype_name': get_ethertype_name(ethertype),
        'payload_length': len(payload)
    }

def format_mac(mac_bytes):
    """Format MAC address bytes to string"""
    return ':'.join(f'{b:02X}' for b in mac_bytes)

def get_ethertype_name(ethertype):
    """Get human-readable EtherType name"""
    ethertypes = {
        0x0800: 'IPv4',
        0x0806: 'ARP',
        0x86DD: 'IPv6',
        0x8100: 'VLAN Tagged (802.1Q)',
        0x8847: 'MPLS Unicast',
        0x88CC: 'LLDP'
    }
    return ethertypes.get(ethertype, 'Unknown')

# Example: Parse a sample frame header
# (In real code, you'd capture this from the network)
sample_frame = bytes([
    0xFC, 0xFB, 0xFB, 0x12, 0x34, 0x56,  # Dest MAC
    0x00, 0x1A, 0x2B, 0x3C, 0x4D, 0x5E,  # Src MAC
    0x08, 0x00,                            # EtherType (IPv4)
    # ... payload would follow
])

parsed = parse_ethernet_frame(sample_frame)
for key, value in parsed.items():
    print(f"{key}: {value}")

LLC and MAC Sublayers

The Data Link Layer is divided into two sublayers:

Ethernet Deep Dive

Ethernet, standardized as IEEE 802.3, has been the dominant LAN technology since the 1980s. Let's explore its evolution and mechanisms.

CSMA/CD: Collision Detection

Carrier Sense Multiple Access with Collision Detection (CSMA/CD) is the media access method used by classic Ethernet:

# CSMA/CD Simulation
import random
import time

class CSMACDSimulator:
    """Simulates CSMA/CD collision handling"""
    
    MAX_ATTEMPTS = 16
    SLOT_TIME = 51.2  # microseconds for 10 Mbps Ethernet
    
    def __init__(self, station_id):
        self.station_id = station_id
        self.attempts = 0
        
    def calculate_backoff(self):
        """
        Binary Exponential Backoff:
        - After n collisions, wait random(0, 2^n - 1) slot times
        - n is capped at 10 (max backoff range = 0-1023 slots)
        """
        k = min(self.attempts, 10)
        max_slots = (2 ** k) - 1
        backoff_slots = random.randint(0, max_slots)
        backoff_time = backoff_slots * self.SLOT_TIME
        return backoff_time, backoff_slots
    
    def transmit(self, collision_occurred=False):
        """Attempt to transmit with collision handling"""
        
        if collision_occurred:
            self.attempts += 1
            
            if self.attempts > self.MAX_ATTEMPTS:
                print(f"Station {self.station_id}: ABORT - Max attempts exceeded")
                return False
            
            backoff_time, slots = self.calculate_backoff()
            print(f"Station {self.station_id}: Collision #{self.attempts}")
            print(f"  Backoff: {slots} slots ({backoff_time:.1f} μs)")
            return 'retry'
        
        self.attempts = 0
        print(f"Station {self.station_id}: Transmission successful!")
        return True

# Simulate multiple stations experiencing collisions
print("=== CSMA/CD Backoff Simulation ===\n")

station = CSMACDSimulator("A")

# Simulate 5 consecutive collisions then success
for i in range(6):
    collision = i < 5  # Collisions for first 5 attempts
    result = station.transmit(collision_occurred=collision)
    if result == True:
        break
    print()

Ethernet Speed Evolution

Wi-Fi (IEEE 802.11)

Wi-Fi operates at the same Data Link and Physical layers as Ethernet, but uses radio waves instead of cables. It uses CSMA/CA (Collision Avoidance) instead of CSMA/CD because wireless stations can't detect collisions while transmitting.

Wi-Fi Security Protocols

Wi-Fi Channels and Frequencies

# Wi-Fi Channel Information
wifi_channels = {
    '2.4 GHz': {
        'channels': list(range(1, 14)),  # Channels 1-13 (14 in Japan)
        'non_overlapping': [1, 6, 11],   # Only 3 non-overlapping channels!
        'channel_width': 20,              # MHz per channel
        'frequency_start': 2412,          # MHz for channel 1
        'channel_spacing': 5              # MHz between channel centers
    },
    '5 GHz': {
        'channels': [36, 40, 44, 48, 52, 56, 60, 64,  # UNII-1 & UNII-2A
                     100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,  # UNII-2C
                     149, 153, 157, 161, 165],  # UNII-3
        'non_overlapping': 'All channels when using 20 MHz width',
        'channel_widths': [20, 40, 80, 160],  # MHz options
    },
    '6 GHz (Wi-Fi 6E/7)': {
        'channels': list(range(1, 234, 4)),  # Many more channels!
        'advantages': 'Less congestion, wider channels, newer devices only'
    }
}

def calculate_frequency(channel, band='2.4 GHz'):
    """Calculate center frequency for a 2.4 GHz channel"""
    if band == '2.4 GHz' and 1 <= channel <= 13:
        return 2407 + (channel * 5)  # MHz
    return None

# Display 2.4 GHz channel layout
print("2.4 GHz Channel Layout:")
print("=" * 50)
for ch in range(1, 14):
    freq = calculate_frequency(ch)
    non_overlap = "✓" if ch in [1, 6, 11] else " "
    print(f"Channel {ch:2d}: {freq} MHz  Non-overlapping: {non_overlap}")

print("\n⚠️  Only channels 1, 6, and 11 don't overlap in 2.4 GHz!")
print("   Using other channels causes interference with neighbors.")

Switches and Bridging

Switches are the workhorses of modern LANs. They operate at Layer 2 and make intelligent forwarding decisions based on MAC addresses.

MAC Address Tables

# View MAC address table on different platforms

# Cisco IOS
show mac address-table

# Example output:
#           Mac Address Table
# -------------------------------------------
# Vlan    Mac Address       Type        Ports
# ----    -----------       --------    -----
#  1      0050.7966.6800    DYNAMIC     Fa0/1
#  1      0050.7966.6801    DYNAMIC     Fa0/2
#  1      0050.7966.6802    DYNAMIC     Fa0/3

# Linux bridge
bridge fdb show

# Windows (from network adapter)
getmac /v

# Simulate a simple Layer 2 switch
class Layer2Switch:
    """Simple Layer 2 switch simulation"""
    
    def __init__(self, num_ports=8):
        self.num_ports = num_ports
        self.mac_table = {}  # {mac_address: port_number}
        self.mac_table_timeout = 300  # seconds (typical aging time)
        
    def receive_frame(self, frame, ingress_port):
        """Process an incoming frame"""
        src_mac = frame['src_mac']
        dst_mac = frame['dst_mac']
        
        # Learn: Update MAC table with source
        self.learn(src_mac, ingress_port)
        
        # Forward decision
        if dst_mac == 'FF:FF:FF:FF:FF:FF':
            # Broadcast - flood to all except source
            return self.flood(ingress_port)
        elif dst_mac in self.mac_table:
            # Known unicast - forward to specific port
            egress_port = self.mac_table[dst_mac]
            if egress_port == ingress_port:
                # Filter - same port, don't forward
                return []
            return [egress_port]
        else:
            # Unknown unicast - flood
            return self.flood(ingress_port)
    
    def learn(self, mac, port):
        """Learn a MAC address"""
        if mac not in self.mac_table:
            print(f"  Learning: {mac} on port {port}")
        self.mac_table[mac] = port
    
    def flood(self, except_port):
        """Flood to all ports except one"""
        return [p for p in range(self.num_ports) if p != except_port]
    
    def show_mac_table(self):
        """Display MAC address table"""
        print("\nMAC Address Table:")
        print("-" * 40)
        print(f"{'MAC Address':<20} {'Port':<10}")
        print("-" * 40)
        for mac, port in sorted(self.mac_table.items()):
            print(f"{mac:<20} {port:<10}")

# Simulation
switch = Layer2Switch(num_ports=4)

frames = [
    {'src_mac': 'AA:AA:AA:AA:AA:01', 'dst_mac': 'BB:BB:BB:BB:BB:02', 'port': 0},
    {'src_mac': 'BB:BB:BB:BB:BB:02', 'dst_mac': 'AA:AA:AA:AA:AA:01', 'port': 1},
    {'src_mac': 'CC:CC:CC:CC:CC:03', 'dst_mac': 'FF:FF:FF:FF:FF:FF', 'port': 2},
    {'src_mac': 'AA:AA:AA:AA:AA:01', 'dst_mac': 'BB:BB:BB:BB:BB:02', 'port': 0},
]

print("Switch Frame Processing:")
print("=" * 50)

for i, frame in enumerate(frames):
    print(f"\nFrame {i+1}: {frame['src_mac']} → {frame['dst_mac']}")
    print(f"  Ingress port: {frame['port']}")
    
    egress_ports = switch.receive_frame(frame, frame['port'])
    
    if len(egress_ports) == 0:
        print(f"  Action: FILTERED (same segment)")
    elif len(egress_ports) == switch.num_ports - 1:
        print(f"  Action: FLOODED to ports {egress_ports}")
    else:
        print(f"  Action: FORWARDED to port {egress_ports[0]}")

switch.show_mac_table()

Spanning Tree Protocol (STP)

When you have redundant paths between switches (for reliability), loops can form. STP prevents broadcast storms by blocking redundant paths:

VLANs: Virtual LANs

VLANs allow you to segment a physical network into multiple logical networks. Devices in different VLANs can't communicate directly—traffic must go through a router (inter-VLAN routing).

802.1Q VLAN Tagging

When frames need to travel between switches, they're "tagged" with a VLAN ID:

Standard Ethernet Frame:
┌──────────┬──────────┬──────────┬─────────┬─────┐
│ Dest MAC │ Src MAC  │EtherType │ Payload │ FCS │
│ (6 bytes)│ (6 bytes)│ (2 bytes)│(46-1500)│(4 B)│
└──────────┴──────────┴──────────┴─────────┴─────┘

802.1Q Tagged Frame:
┌──────────┬──────────┬──────────────┬──────────┬─────────┬─────┐
│ Dest MAC │ Src MAC  │   802.1Q     │EtherType │ Payload │ FCS │
│ (6 bytes)│ (6 bytes)│   Tag        │ (2 bytes)│(46-1500)│(4 B)│
│          │          │  (4 bytes)   │          │         │     │
└──────────┴──────────┴──────────────┴──────────┴─────────┴─────┘

802.1Q Tag (4 bytes):
┌────────────────┬─────────┬──────────────┐
│     TPID       │   TCI                  │
│   (2 bytes)    │   (2 bytes)            │
│   0x8100       │                        │
└────────────────┴─────────┬──────────────┘
                           │
                    ┌──────┴───────┐
                    │ PCP │DEI│VID │
                    │(3b) │(1b)│(12b)│
                    └──────────────┘

TPID: Tag Protocol Identifier (always 0x8100)
PCP:  Priority Code Point (QoS, 0-7)
DEI:  Drop Eligible Indicator
VID:  VLAN Identifier (1-4094, 0 and 4095 reserved)

# Parse and create 802.1Q VLAN tags
import struct

def create_vlan_tag(vlan_id, priority=0, dei=0):
    """
    Create an 802.1Q VLAN tag
    
    Args:
        vlan_id: VLAN ID (1-4094)
        priority: PCP value (0-7)
        dei: Drop Eligible Indicator (0 or 1)
    
    Returns:
        4-byte VLAN tag
    """
    if not 1 <= vlan_id <= 4094:
        raise ValueError("VLAN ID must be 1-4094")
    if not 0 <= priority <= 7:
        raise ValueError("Priority must be 0-7")
    
    tpid = 0x8100
    # TCI = PCP (3 bits) + DEI (1 bit) + VID (12 bits)
    tci = (priority << 13) | (dei << 12) | vlan_id
    
    return struct.pack('!HH', tpid, tci)

def parse_vlan_tag(tag_bytes):
    """Parse an 802.1Q VLAN tag"""
    tpid, tci = struct.unpack('!HH', tag_bytes)
    
    if tpid != 0x8100:
        raise ValueError(f"Invalid TPID: {hex(tpid)}")
    
    priority = (tci >> 13) & 0x07
    dei = (tci >> 12) & 0x01
    vlan_id = tci & 0x0FFF
    
    return {
        'tpid': hex(tpid),
        'priority': priority,
        'dei': dei,
        'vlan_id': vlan_id
    }

# Examples
print("Creating VLAN tags:")
print("-" * 40)

test_cases = [
    (100, 0, 0),   # VLAN 100, default priority
    (200, 5, 0),   # VLAN 200, high priority (voice)
    (300, 0, 1),   # VLAN 300, drop eligible
]

for vlan_id, priority, dei in test_cases:
    tag = create_vlan_tag(vlan_id, priority, dei)
    parsed = parse_vlan_tag(tag)
    print(f"VLAN {vlan_id}, Priority {priority}, DEI {dei}")
    print(f"  Raw bytes: {tag.hex()}")
    print(f"  Parsed: {parsed}")
    print()

Access Ports vs Trunk Ports

# Cisco IOS VLAN Configuration Examples

# Create VLANs
Switch(config)# vlan 10
Switch(config-vlan)# name Engineering
Switch(config-vlan)# vlan 20
Switch(config-vlan)# name Finance
Switch(config-vlan)# vlan 30
Switch(config-vlan)# name Guest

# Configure Access Port (connects to end device)
Switch(config)# interface FastEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

# Configure Trunk Port (connects to another switch)
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport trunk native vlan 1

# View VLAN configuration
Switch# show vlan brief
Switch# show interfaces trunk

ARP: Address Resolution Protocol

ARP bridges Layer 2 and Layer 3 by mapping IP addresses to MAC addresses. When your computer wants to send data to another device on the same network, it needs to know the destination's MAC address.

Working with ARP

# View ARP cache on different systems

# Windows
arp -a

# Linux/macOS
arp -n
# or
ip neighbor show

# Example output:
# 192.168.1.1      ether   00:11:22:33:44:55   C   eth0
# 192.168.1.100    ether   aa:bb:cc:dd:ee:ff   C   eth0

# Clear ARP cache
# Windows (Admin)
arp -d *

# Linux
sudo ip neighbor flush all

# Add static ARP entry (prevent ARP spoofing for critical hosts)
# Linux
sudo arp -s 192.168.1.1 00:11:22:33:44:55

# Windows
arp -s 192.168.1.1 00-11-22-33-44-55

# ARP packet structure
import struct

def parse_arp_packet(data):
    """
    Parse an ARP packet
    
    ARP Header (28 bytes for IPv4/Ethernet):
    - Hardware type: 2 bytes (1 = Ethernet)
    - Protocol type: 2 bytes (0x0800 = IPv4)
    - Hardware addr length: 1 byte (6 for Ethernet)
    - Protocol addr length: 1 byte (4 for IPv4)
    - Operation: 2 bytes (1 = Request, 2 = Reply)
    - Sender hardware addr: 6 bytes
    - Sender protocol addr: 4 bytes
    - Target hardware addr: 6 bytes
    - Target protocol addr: 4 bytes
    """
    
    # Unpack fixed header
    hw_type, proto_type, hw_len, proto_len, operation = struct.unpack('!HHBBH', data[:8])
    
    # Unpack addresses (assuming Ethernet/IPv4)
    offset = 8
    sender_mac = data[offset:offset+6]
    offset += 6
    sender_ip = data[offset:offset+4]
    offset += 4
    target_mac = data[offset:offset+6]
    offset += 6
    target_ip = data[offset:offset+4]
    
    operations = {1: 'ARP Request', 2: 'ARP Reply'}
    
    return {
        'hardware_type': hw_type,
        'protocol_type': hex(proto_type),
        'operation': operations.get(operation, f'Unknown ({operation})'),
        'sender_mac': ':'.join(f'{b:02x}' for b in sender_mac),
        'sender_ip': '.'.join(str(b) for b in sender_ip),
        'target_mac': ':'.join(f'{b:02x}' for b in target_mac),
        'target_ip': '.'.join(str(b) for b in target_ip),
    }

# Example ARP Request packet
arp_request = bytes([
    0x00, 0x01,              # Hardware type: Ethernet
    0x08, 0x00,              # Protocol type: IPv4
    0x06,                    # Hardware addr length: 6
    0x04,                    # Protocol addr length: 4
    0x00, 0x01,              # Operation: ARP Request
    0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,  # Sender MAC
    0xc0, 0xa8, 0x01, 0x01,  # Sender IP: 192.168.1.1
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  # Target MAC (unknown)
    0xc0, 0xa8, 0x01, 0x64,  # Target IP: 192.168.1.100
])

parsed = parse_arp_packet(arp_request)
print("ARP Packet Analysis:")
print("-" * 40)
for key, value in parsed.items():
    print(f"{key}: {value}")

Hands-On Exercises

Exercise 1: Network Discovery

# Discover devices on your local network

# Method 1: Ping sweep + ARP
# Linux
for ip in $(seq 1 254); do 
    ping -c 1 -W 1 192.168.1.$ip &>/dev/null && echo "192.168.1.$ip is alive" &
done
wait
arp -n

# Method 2: nmap (comprehensive)
sudo nmap -sn 192.168.1.0/24

# Method 3: Windows
for /L %i in (1,1,254) do @ping -n 1 -w 100 192.168.1.%i >nul && echo 192.168.1.%i is alive
arp -a

Exercise 2: Python Network Tools

# Get your own MAC and IP addresses
import socket
import uuid
import subprocess
import platform

def get_mac_address():
    """Get the MAC address of the default interface"""
    mac = ':'.join(['{:02x}'.format((uuid.getnode() >> ele) & 0xff)
                    for ele in range(0, 8*6, 8)][::-1])
    return mac.upper()

def get_local_ip():
    """Get the local IP address"""
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    try:
        # Connect to external address (doesn't actually send data)
        s.connect(('8.8.8.8', 80))
        ip = s.getsockname()[0]
    except Exception:
        ip = '127.0.0.1'
    finally:
        s.close()
    return ip

def get_default_gateway():
    """Get default gateway (platform-specific)"""
    system = platform.system()
    
    if system == 'Windows':
        result = subprocess.run(['ipconfig'], capture_output=True, text=True)
        for line in result.stdout.split('\n'):
            if 'Default Gateway' in line and ':' in line:
                parts = line.split(':')
                if len(parts) > 1:
                    gateway = parts[1].strip()
                    if gateway:
                        return gateway
    else:  # Linux/macOS
        result = subprocess.run(['ip', 'route'], capture_output=True, text=True)
        for line in result.stdout.split('\n'):
            if line.startswith('default'):
                return line.split()[2]
    
    return 'Unknown'

# Display network information
print("Local Network Information")
print("=" * 40)
print(f"MAC Address:      {get_mac_address()}")
print(f"Local IP:         {get_local_ip()}")
print(f"Default Gateway:  {get_default_gateway()}")
print(f"Hostname:         {socket.gethostname()}")

Exercise 3: Capture and Analyze Frames

# Use tcpdump to capture Ethernet frames

# Capture ARP traffic
sudo tcpdump -i any -n arp

# Capture and show Ethernet headers
sudo tcpdump -i eth0 -e -n -c 10

# Example output:
# 14:30:45.123456 aa:bb:cc:dd:ee:ff > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806)
# 14:30:45.123789 11:22:33:44:55:66 > aa:bb:cc:dd:ee:ff, ethertype ARP (0x0806)

# Save capture for Wireshark analysis
sudo tcpdump -i any -w layer2_capture.pcap

# Then open in Wireshark:
# wireshark layer2_capture.pcap

Summary & Next Steps

Continue the Series