It’s worth remembering that IP packets exist independently of the underlying transport. This is one of IP’s greatest strengths: packets can traverse multiple physical and link-layer technologies without modification. With suitable routing and forwarding, the same IP packet can move across Ethernet, Wi-Fi, and other link-layer protocols without needing to change its structure.

The Open Systems Interconnection (OSI) model provides a useful abstraction for understanding this behavior. Each layer performs a specific role, and data is encapsulated as it moves down the stack and decapsulated as it moves up again at the receiving device.

For example, a camera streaming uncompressed video to a production system will packetize video into RTP streams as defined by SMPTE ST 2110-20. These RTP packets are encapsulated within UDP/IP (Layer 3), then carried within Ethernet frames (Layer 2), and finally transmitted over a physical medium such as fiber (Layer 1). At the receiver, this process is reversed to reconstruct the original video stream.

Flexible Security

This layered approach provides significant flexibility. The physical medium between devices can change without affecting the IP layer. For example, a camera may connect via fiber while the receiving device connects via copper (e.g. CAT6/7/8). The Ethernet switch handles this transition transparently, without modifying the IP packets themselves.

In networking terms, a Local Area Network (LAN) consists of devices within the same Layer 2 broadcast domain, where broadcast frames are forwarded to all members of that domain. Modern LANs often consist of multiple interconnected Ethernet switches, with segmentation provided through VLANs to isolate traffic between different operational areas such as studios.

While Layer 2 networks provide low latency and operational simplicity, they do not inherently provide strong security guarantees, particularly in large or shared environments.

Traditional IPsec-based VPNs operate at Layer 3 and are typically used to secure traffic across routed networks. Applying similar protections within a Layer 2 domain is not straightforward without introducing additional complexity or latency.

This is where MACsec becomes particularly valuable. Defined by IEEE 802.1AE, MACsec operates at Layer 2 and provides confidentiality, integrity, and authenticity for Ethernet frames on a hop-by-hop basis.

Standardizing Security

MACsec introduces a security layer between directly connected devices, such as between two Ethernet switches, or between an endpoint device and a switch. Each secured link is independent, meaning that traffic is decrypted and re-encrypted at every hop.

MACsec adds two key components to the Ethernet frame:

• A Security Tag (SecTAG), which includes information such as packet number and association identifiers.
• An Integrity Check Value (ICV), which provides cryptographic authentication of the frame.

The SecTAG includes a packet number that enables replay protection, ensuring that captured frames cannot be resent by an attacker without detection.

Encryption is applied to the payload and selected header fields (such as the EtherType), while the source and destination MAC addresses remain in the clear to allow normal switching behavior.

Key establishment is handled through the MACsec Key Agreement (MKA) protocol, defined within IEEE 802.1X. In most deployments, devices authenticate using 802.1X mechanisms and derive keys dynamically, although pre-shared key configurations are also supported. From this process, Secure Association Keys (SAKs) are generated and used to encrypt traffic.

The addition of the SecTAG and ICV increases the Ethernet frame size by approximately 24–32 bytes, depending on configuration. This overhead must be accounted for in network design, particularly in high-throughput environments.

When a frame is received, the device verifies the ICV before processing it further. Any modification to the frame invalidates the ICV, and only devices possessing the correct key can generate a valid replacement. Frames that fail validation are discarded.

Why MACsec Matters In Broadcast Networks

Broadcast IP networks are often assumed to be trusted environments. However, this assumption can break down in several realistic scenarios:

• Shared infrastructure between production, IT, and external systems.
• Remote production workflows extending into less controlled environments.
• Insider threats or misconfigured devices injecting unintended traffic.

In these situations, the ability to authenticate and verify every Ethernet frame becomes critical. MACsec ensures that only trusted devices can inject traffic into the network, preventing both accidental and malicious disruption.

This is particularly important in ST-2110 environments, where even small amounts of unexpected traffic or malformed packets can lead to buffer pressure, timing instability, or loss of media integrity.

Unicast & Multicast Encryption

One of the key advantages of MACsec is its ability to secure unicast, multicast, and broadcast traffic within a Layer 2 domain. This is particularly relevant in broadcast environments, where multicast is widely used for efficient distribution of video streams.

Unlike higher-layer security mechanisms, MACsec does not interfere with multicast replication within the network. Encryption occurs per link, while the switching fabric continues to replicate frames as normal.

This makes MACsec particularly well suited to ST-2110 environments, where high-bandwidth multicast streams must be distributed efficiently without introducing additional complexity or control-plane overhead.

While standards exist for multicast security with IPsec, they typically rely on complex group key management mechanisms and are not widely deployed in real-time media networks.

However, MACsec operates on a hop-by-hop basis and is limited to Layer 2 domains. It does not provide end-to-end encryption across routed networks without additional mechanisms.

A Critical Limitation

MACsec operates on a hop-by-hop basis. Each device decrypts and re-encrypts traffic as it traverses the network.

This has an important implication: MACsec does not provide end-to-end confidentiality across a multi-hop network. Instead, it ensures that each link between devices is secure.

In a broadcast facility, this means that every intermediate switch must be trusted and correctly configured. A single non-MACsec segment breaks the chain of protection.

Operational Considerations

Because MACsec is implemented in hardware within NICs and switch ASICs, encryption occurs at line rate with negligible additional latency. This is critical in real-time media networks, where even small increases in latency or jitter can contribute to buffer pressure and packet timing instability.

As with any cryptographic system, the overall security of MACsec depends heavily on key management. If key material is compromised, encrypted traffic can be decrypted regardless of the strength of the underlying algorithms. Robust authentication, secure key storage, and controlled access are therefore essential.

MACsec provides a powerful additional layer of security for broadcasters, particularly within production networks where low latency and deterministic behavior are critical. Its effectiveness, however, depends on end-to-end support across connected devices.

Providing low-latency, hardware-enforced encryption at Layer 2, this approach is well suited to securing broadcast production networks. In practice, it complements rather than replaces higher-layer mechanisms such as IPsec, with in-facility infrastructure protected at Layer 2 while IPsec or similar technologies secure traffic across untrusted or routed networks.