MACsec (MAC Security)

Layer-2 link encryption: hop by hop, MAC header in the clear. MACsec sits at Layer 2 - Data Link, defined in IEEE 802.1AE.

What it is for.
Two crucial limits.
★ Common misconceptions.

All labs

MPLS Label Switching — How an MPLS label switched path is signalled and how packets are forwarded by label instead of by a destination lookup at every hop. Watch the label stack get pushed, swapped and popped hop by hop, including penultimate hop popping.
SR-TE Segment Routing — Segment Routing traffic engineering: the path is carried in the packet as a label stack, so there is no per-hop signalling state to maintain. Compare an SR-TE explicit path against plain IGP shortest path and see which links actually carry the traffic.
eBGP — How autonomous systems interconnect with external BGP: session establishment, route advertisement, and how AS_PATH prevents loops between providers. Includes the attribute decision process that picks the best path.
iBGP — Carrying externally learned routes inside an AS: why iBGP does not re-advertise routes between peers, why that forces either a full mesh or a route reflector, and how next-hop-self and the IGP underlay fit together.
OSPF Link State — Flood LSAs to build an identical map of the network on every router, then run Dijkstra on it. Step through adjacency states, LSA types, area design and the SPF run that produces the routing table.
IS-IS Link State — The other link-state IGP, the one carriers actually run: L1/L2 levels instead of areas, TLV-encoded LSPs that extend without a protocol revision, and a topology that rides directly on layer 2.
EIGRP Distance Vector — DUAL in action: successors and feasible successors are computed before anything breaks, so failover is a table lookup rather than a re-convergence. See exactly when a router has to go active and query its neighbours.
RIP Distance Vector — The simplest distance vector protocol, kept here because it is the clearest way to watch the count-to-infinity problem happen — and to see exactly which of split horizon, route poisoning and hold-down timers stops it.
Data Center Spine-Leaf — How a fat-tree data center fabric is actually dimensioned: oversubscription ratio, ECMP hashing across spines, and what an elephant flow does to a hash-based load spread.
OTN/ODF Optical Network — How data centers actually interconnect over the physical optical layer: which devices a layer-1 circuit passes through from router to router, how a ROADM decides to add, drop or express a wavelength, and how ring protection survives a fiber cut.
IDC Topology — How a region's data centers are laid out and related: core, aggregation, business, satellite, interconnect, scrubbing, PoP and colocation sites, active-active vs active-standby pairs, fiber distance and RTT computed from real coordinates, order-of-magnitude traffic, and a failover drill — take a DC or a backbone span down and watch who gets isolated, promoted or detoured. Modeled on AWS global regions and China's multi-region layout.
Layer 2 Switching — What a switch actually does with a frame: learn the source MAC, look up the destination, flood when it is unknown. Includes ARP resolution and the broadcast domain that ties it all together.
STP Spanning Tree — Redundant links plus a flat layer 2 equals a broadcast storm. STP computes a loop-free tree and blocks the rest: root bridge election, port roles and states, and what a topology change actually costs.
Layer 3 Static Routing — Longest prefix match decided hop by hop, plus the classic trap that catches everyone once: routing is one-way, so a reachable destination with no return route still fails.
DNS — Walk a name resolution the way a resolver does: root → TLD → authoritative, one referral at a time. Recursive vs iterative queries, the roles of authoritative, recursive and forwarding servers, and where caching and TTL change the answer.
Load Balancing — Three decision granularities side by side: L3 sends a client to a server, L4 pins a connection, L7 can route every single request. See what each one can and cannot see, and where session persistence has to come from.
RDMA — Zero copy and kernel bypass: the NIC writes straight into remote memory, so the CPU and the kernel network stack are not on the path at all. That is also why RDMA traffic needs a lossless fabric and does not tolerate the drops TCP shrugs off.
InfiniBand — Ethernet vs RoCE vs InfiniBand, compared three ways. Inside the host the verbs interface is identical — every real difference lives in the network: credit-based flow control, a centralized subnet manager, and link-level reliability instead of end-to-end retries.
VLAN Layer 2 Isolation — 802.1Q tagging: many independent broadcast domains sharing one physical wire. Access ports, trunk ports, the native VLAN, and why two hosts on the same switch with the same subnet still cannot reach each other.
VPN Encrypted Tunnels — Site-to-site and remote access side by side: how the tunnel is negotiated, what the encapsulated packet looks like on the wire, and which traffic the split-tunnel policy actually sends through it.
SSL/TLS — The handshake in full: how the certificate chain is validated up to a trusted root, how the session key is agreed without ever sending it, and what actually changed in TLS 1.3.
Network Products by Layer — A vendor-neutral map of networking products from layer 1 to layer 7: what capability lives at each layer, which vendors worldwide sell it, and the order of magnitude of price and performance.
Security Products by Layer — Security capabilities placed by layer: firewall, IPS, WAF, DDoS scrubbing, zero trust, DNS security, and which vendors offer each.
Network Equipment Vendors L1-L7 — Cisco, Arista, Juniper, Huawei, H3C, Ruijie, Ciena, Nokia, F5, A10, Extreme, Aruba, Ubiquiti, NETGEAR, TP-Link, Calix, Accton / Edgecore: each vendor's product lines from optical transport to application delivery, with company background and flagship layers.
Networking Silicon L1-L7 — Broadcom, NVIDIA, Marvell and the other chip makers inside the switches and NICs: what merchant silicon changed about the equipment business, and which layers each vendor's chips implement.
Carriers L1-L7 — AT&T, Verizon, NTT, Comcast, Cogent, Colt, Lumen, Telstra, China Telecom and two dozen more: what a carrier sells at each layer, from dark fiber and wavelengths to private lines, IP transit and cloud on-ramps.
Data Center Operators L1-L7 — Equinix, Digital Realty, CoreSite, Colt DCS and others: what a data center operator actually provides — space, power, cooling, cross-connects, interconnection fabrics — and what it leaves to you.
Internet Exchanges L1-L7 — DE-CIX, AMS-IX, LINX, Equinix IX and other Internet exchanges: how an IXP works, what a port and a peering session cost, and where the route servers sit.
Submarine Cable Systems — The companies that build and operate transoceanic fiber: who owns a cable system, how capacity is sold as wavelengths and IRUs, and where the landing stations connect to the rest of the network.
Cloud Providers L1-L7 — AWS, Azure, Google Cloud, Alibaba Cloud and Oracle Cloud: what each public cloud turned every layer into as a product — from dedicated interconnects and VPCs to load balancers, WAFs and DNS.
Neocloud / AI Cloud Providers — CoreWeave, Lambda, Crusoe, Nebius, Nscale, Together AI, FluidStack: clouds built around GPU clusters, and why their network layers — InfiniBand, RoCE, high-radix fabrics — look nothing like a general-purpose cloud's.
Satellite & LEO Internet — Starlink and other LEO and GEO satellite Internet providers: what the access layer looks like, where the latency comes from, and how the ground segment joins the terrestrial Internet.
CDN & Edge Providers L4-L7 — Akamai, Cloudflare and Fastly: what content delivery and edge compute do at layers 4 to 7 — caching, TLS termination, WAF, DDoS absorption, edge functions — and how they are priced.
DNS Providers — Cloudflare DNS, Quad9, Cisco Umbrella, DNSFilter and others: authoritative DNS, recursive resolvers and DNS security as products — features, pricing and what each one can see.
Security Vendors L1-L7 — Palo Alto Networks, Fortinet, Zscaler, Check Point, Qihoo 360 and others: each security vendor's products placed at the layer where they operate — NGFW, SASE, ZTNA, EDR, DNS security — with company background.
VXLAN Encapsulation — The data plane: how an L2 frame gets 50 bytes of outer headers and crosses a pure L3 underlay.
EVPN Control Plane — The control plane: MP-BGP tells everyone where every MAC is, before the first packet.
Flow Observability — NetFlow / IPFIX / sFlow: the gap between what your reports show and what actually happened.
Telemetry & Streaming — SNMP polling to gNMI streaming: the interval decides both what you can see and whether the device survives.
BMP Route Observability — Why isn't this route in my table -- they never sent it, or my policy dropped it? The pre/post difference answers it.
syslog Log Observability — Absent from the logs does not mean it did not happen -- a line must pass four gates, and all four tighten during a fault.
Data Center Architecture Evolution — From 2 servers to a million: how business needs force each new architecture.
Transport Network Evolution — From 2 servers again, but purely about the network: when you are forced to a new device tier.
Wireless Evolution — 1G to 6G plus Starlink: each generation forced by a limit of the last.
Ethernet — Ethernet framing and MAC addressing: how a switch learns its table by itself. Ethernet sits at Layer 2 - Data Link, defined in IEEE 802.3.
ARP (Address Resolution Protocol) — IP to MAC: broadcast the question, unicast the answer, and why you only ever ARP the gateway. ARP sits at Layer 2 - Data Link, defined in RFC 826.
VLAN (Virtual Local Area Network) — A VLAN tag carves one switch into separate broadcast domains. VLAN sits at Layer 2 - Data Link, defined in IEEE 802.1Q.
QinQ (802.1Q-in-802.1Q) — Two VLAN tags: the carrier wraps its own around the customer’s. QinQ sits at Layer 2 - Data Link, defined in IEEE 802.1ad.
STP (Spanning Tree Protocol) — Spanning tree: an Ethernet header has no TTL, so loops never stop. STP sits at Layer 2 - Data Link, defined in IEEE 802.1D.
RSTP (Rapid Spanning Tree Protocol) — Rapid spanning tree: a handshake instead of timers. RSTP sits at Layer 2 - Data Link, defined in IEEE 802.1w.
MSTP (Multiple Spanning Tree Protocol) — Multiple spanning tree: one tree per VLAN group. MSTP sits at Layer 2 - Data Link, defined in IEEE 802.1s.
LACP (Link Aggregation Control Protocol) — Link aggregation: both cables forward instead of one being blocked. LACP sits at Layer 2 - Data Link, defined in IEEE 802.1AX.
LLDP (Link Layer Discovery Protocol) — Neighbour discovery: who is on the other end -- one hop only. LLDP sits at Layer 2 - Data Link, defined in IEEE 802.1AB.
CDP (Cisco Discovery Protocol) — Cisco’s proprietary discovery -- other vendors cannot read it. CDP sits at Layer 2 - Data Link.
PPP (Point-to-Point Protocol) / PPPoE (PPP over Ethernet) — Broadband dial-up auth and encapsulation, and why the MTU becomes 1492. PPP / PPPoE sits at Layer 2 - Data Link, defined in RFC 1661 / 2516.
MACsec (MAC Security) — Layer-2 link encryption: hop by hop, MAC header in the clear. MACsec sits at Layer 2 - Data Link, defined in IEEE 802.1AE.
Wi-Fi MAC (Medium Access Control) — Wireless layer 2: three or four addresses, an ACK per frame. Wi-Fi MAC sits at Layer 2 - Data Link, defined in IEEE 802.11.
IPv4 (Internet Protocol version 4) — Addressing, TTL loop prevention and fragmentation -- none of which Ethernet can do. IPv4 sits at Layer 3 - Network, defined in RFC 791.
IPv6 (Internet Protocol version 6) — A fixed 40-byte header, no checksum, and routers that never fragment. IPv6 sits at Layer 3 - Network, defined in RFC 8200.
ICMP (Internet Control Message Protocol) — Ping and error reporting -- traceroute is built from it plus TTL. ICMP sits at Layer 3 - Network, defined in RFC 792.
ICMPv6 (Internet Control Message Protocol for IPv6) — NDP, RA, MLD and PMTUD all ride on it -- blocking it breaks the network. ICMPv6 sits at Layer 3 - Network, defined in RFC 4443.
NDP (Neighbor Discovery Protocol) — IPv6’s ARP, but multicast not broadcast, and it autoconfigures addresses too. NDP sits at Layer 3 - Network, defined in RFC 4861.
IGMP (Internet Group Management Protocol) — Hosts say which group they want -- switches must eavesdrop with snooping. IGMP sits at Layer 3 - Network, defined in RFC 3376.
MLD (Multicast Listener Discovery) — IGMP for IPv6, and more critical -- because NDP itself is multicast. MLD sits at Layer 3 - Network, defined in RFC 3810.
IPsec (IP Security) AH (Authentication Header) / ESP (Encapsulating Security Payload) — End-to-end encryption unlike MACsec’s hop-by-hop, at 50-60 bytes. IPsec AH / ESP sits at Layer 3 - Network, defined in RFC 4302 / 4303.
GRE (Generic Routing Encapsulation) — The plainest layer-3 tunnel -- unencrypted, and mind recursive routing. GRE sits at Layer 3 - Network, defined in RFC 2784.
VRRP (Virtual Router Redundancy Protocol) / HSRP (Hot Standby Router Protocol) / GLBP (Gateway Load Balancing Protocol) — Gateway redundancy: a virtual IP and MAC, so hosts change nothing. VRRP / HSRP / GLBP sits at Layer 3 - Network, defined in RFC 5798.
TCP (Transmission Control Protocol) — Connection-oriented, reliable, ordered -- supplying what UDP lacks. TCP sits at Layer 4 - Transport, defined in RFC 9293.
UDP (User Datagram Protocol) — Adds one thing, ports -- layer 3 reaches the host, layer 4 the process. UDP sits at Layer 4 - Transport, defined in RFC 768.
SCTP (Stream Control Transmission Protocol) — Multi-streaming and multi-homing -- not even QUIC does the second. SCTP sits at Layer 4 - Transport, defined in RFC 9260.
QUIC — Runs on UDP: TCP's machinery in user space, fixing head-of-line blocking. QUIC sits at Layer 4 - Transport, defined in RFC 9000.
HTTP (Hypertext Transfer Protocol) 1.1 / 2 / 3 — One set of semantics, three packings: text, binary frames, then QUIC. HTTP 1.1 / 2 / 3 sits at Layer 7 - Application, defined in RFC 9110 / 9113 / 9114.
WebSocket — One HTTP handshake; after the 101 the server can finally speak first. WebSocket sits at Layer 7 - Application, defined in RFC 6455.
DHCP (Dynamic Host Configuration Protocol) / DHCPv6 — How a machine with no address asks for one -- and why IPv6 splits the job. DHCP / DHCPv6 sits at Layer 7 - Application, defined in RFC 2131 / 8415.
RADIUS (Remote Authentication Dial-In User Service) / LDAP (Lightweight Directory Access Protocol) — RADIUS answers whether to admit you, LDAP answers who you are. RADIUS / LDAP sits at Layer 7 - Application, defined in RFC 2865 / 4511.
FTP (File Transfer Protocol) / TFTP (Trivial File Transfer Protocol) / NFS (Network File System) — Three models: move a whole file, move one from nothing, or mount remotely. FTP / TFTP / NFS sits at Layer 7 - Application, defined in RFC 959 / 1350 / 1813.
SMTP (Simple Mail Transfer Protocol) / POP3 (Post Office Protocol version 3) / IMAP (Internet Message Access Protocol) — Sending and receiving are separate protocols -- hence two server fields. SMTP / POP3 / IMAP sits at Layer 7 - Application, defined in RFC 5321 / 1939 / 9051.
Telnet / SSH (Secure Shell) / RDP (Remote Desktop Protocol) — Plaintext, encrypted, then a screen. SFTP is here -- a subsystem of SSH. Telnet / SSH / RDP sits at Layer 7 - Application, defined in RFC 854 / 4251 / MS-RDPBCGR.
NTP (Network Time Protocol) / PTP (Precision Time Protocol) — The hard part is subtracting the transit -- milliseconds versus nanoseconds. NTP / PTP sits at Layer 7 - Application, defined in RFC 5905 / IEEE 1588.
Cross-layer - Control & Data Plane — One picture: purple lines decide the path, blue ones move the packets. Cross-layer - Control & Data Plane sits at Cross-layer - Control & Data Plane.

Home · All labs · About · Contact · Privacy · Terms

© 2025-2026 IP History Inc, all rights reserved. | Contact: isppub.com@gmail.com | Last updated 2026-10-26

Protocol notes for this page (click to expand)

MACsec (MAC Security)

What it is for

The fibre between two sites runs through public ducts where anyone could tap it with a splitter. Ethernet frames are plaintext, so a tap sees everything.

★★★ MACsec encrypts frames on that one link: encrypt before sending, decrypt on arrival. A tap sees only ciphertext.

Two crucial limits

★★★ (1) The MAC header is not encrypted. Destination and source MACs must stay readable or switches cannot forward. So an attacker still sees who talks to whom, just not the contents.

★★★ (2) Hop by hop, not end to end. Each link encrypts and decrypts independently, so inside the intermediate switch the frame is plaintext.

★★ Compare IPsec: end to end, with no device in the middle ever seeing plaintext. They address different threats -- MACsec against a tapped cable, IPsec against untrusted devices en route.

★ Common misconceptions

★★★ "MACsec means I do not need IPsec" -- wrong. MACsec protects one link; the data is plaintext inside every intermediate switch. End-to-end confidentiality requires IPsec or TLS.

★★ "Encryption hides who is communicating" -- it does not. The MAC header is plaintext, so traffic analysis (who, how much, when) still works.

★★ "There is no cost" -- every frame grows 24-32 bytes (SecTAG plus ICV), the MTU must be raised, and line-rate encryption needs dedicated hardware.