6.3 Ethernet Frames

Framing Data on Ethernet

Ethernet frames are the basic containers that carry data across wired Ethernet networks. Whenever a device sends something over Ethernet, it does not just throw raw bits on the wire. It wraps those bits in a specific structure called a frame. Understanding this structure is essential before you dive deeper into switching, MAC addresses, VLANs, and troubleshooting.

In this chapter, the focus is on what an Ethernet frame looks like, what fields it contains, and why each field exists. Higher level concepts such as IP addressing or switching behavior are handled in other chapters, so they will be mentioned only briefly when necessary.

The Role of an Ethernet Frame

An Ethernet frame is a package of data that moves between devices on the same Ethernet network. It groups together:

Data that you care about, for example an IP packet carrying a web request.

Control information that Ethernet itself needs, for example where the frame comes from and where it should go at the data link level.

This separation allows Ethernet devices such as switches and network interface cards to process and move data without needing to understand the full details of the content inside.

You can think of the frame as an envelope. The outside of the envelope has addressing and control details. The letter inside can be anything, but the postal system mostly cares about what is written on the outside.

Standard Ethernet Frame Structure

A standard Ethernet frame (IEEE 802.3) has several fields in a fixed order. At a high level, the structure looks like this, from first bit sent to last:

Some fields are always present, others appear only in specific cases such as VLAN tagging. The interframe gap is not technically part of the frame, but it is part of how Ethernet spaces out transmissions on the medium.

Preamble and Start Frame Delimiter

At the physical layer, receiving devices must know exactly when a frame starts and must synchronize their clocks with the incoming bit stream. For this purpose Ethernet uses a preamble and a start frame delimiter.

The preamble is 7 bytes long and consists of a repeating pattern: 10101010 in binary. In hexadecimal this is $0xAA$. This alternating pattern allows the receiver to lock onto the timing of the signal and prepare for real data.

Immediately after the preamble comes the Start Frame Delimiter, often called SFD. It is 1 byte with the bit pattern 10101011, hexadecimal $0xAB$. The SFD marks the end of synchronization bits and the exact beginning of the frame header.

These two fields are handled by the physical and data link hardware. Typical packet captures may show the frame starting from the destination MAC address. The preamble and SFD are usually stripped before the frame reaches software in the operating system.

MAC Address Fields

After the SFD, the first part of the visible Ethernet frame header consists of the destination and source MAC addresses.

Each MAC address is 6 bytes long, or 48 bits. They are written as six groups of two hexadecimal digits, for example:

12:34:56:78:9A:BC

Destination MAC tells the Ethernet devices where the frame should be delivered on the local network segment. Source MAC tells the receiver who sent the frame. Switches use these addresses to make forwarding decisions, but the process itself is covered in the MAC learning and switching chapters.

There are three basic types of destination MAC addresses:

The source MAC address is always a unicast address of the sending device, never broadcast.

Optional Tag Fields

Between the source MAC address and the EtherType or Length field there may be an additional tag field. The most common example is the 802.1Q VLAN tag, which is 4 bytes long. It carries information such as the VLAN ID used by the frame.

Tagged frames are used in environments where multiple virtual LANs share the same physical link. The detailed behavior of VLANs and 802.1Q is covered in later chapters. For now, it is enough to understand that some Ethernet frames are longer than others because of this extra tag.

In captures, a tagged Ethernet frame will show an extra field after the source MAC, usually with EtherType 0x8100 indicating an 802.1Q tag, followed by VLAN related bits and then the real EtherType for the payload.

EtherType and Length Field

After the addresses (and optional tag) comes a 2 byte field which has two possible meanings depending on its value.

For modern Ethernet, it is usually an EtherType field. For older IEEE 802.3 frames without EtherType, the same 2 bytes represent the length of the payload.

In practice, values greater than or equal to 1536 (0x0600 in hexadecimal) are interpreted as EtherType values. Values less than or equal to 1500 specify the length of the payload in bytes.

This rule allows the receiver to understand whether it is looking at a length field or a protocol identifier.

Common EtherType values include:

This field allows Ethernet to carry many different higher layer protocols without confusion.

Payload (Data) Field

The payload is the section where the actual higher layer data lives. In most modern networks this is an IP packet, but it can be many other protocols.

The payload size in a standard Ethernet frame must follow two important rules:

Minimum payload size is 46 bytes.

Maximum payload size is 1500 bytes.

If the higher layer data is shorter than 46 bytes, padding bytes are added to fill the minimum size. These padding bytes do not carry meaningful information and are ignored by the receiving host once it processes the payload based on the higher layer header.

The maximum payload size of 1500 bytes is known as the Ethernet Maximum Transmission Unit, or Ethernet MTU. Some networks use larger frames called jumbo frames, but the standard Ethernet MTU remains 1500 bytes.

If the upper layer wants to send more than 1500 bytes of data, it must split that data into multiple packets, which are then carried in multiple Ethernet frames.

Frame Check Sequence and Error Detection

At the end of the Ethernet frame is the Frame Check Sequence, often abbreviated as FCS. It is 4 bytes long and is calculated using a Cyclic Redundancy Check, or CRC.

The sender takes all the bits from the destination MAC address up to the end of the payload and computes a CRC value. This value is placed in the FCS field.

When the receiver gets the frame, it performs the same CRC calculation over the received bits and compares its result with the FCS value in the frame.

If the two values match, the receiver assumes that the frame arrived without corruption. If they do not match, the frame is considered corrupted and is discarded.

The exact polynomial used for Ethernet CRC is standardized, but you rarely need the bit level math. What matters is the behavior:

Frames with a bad FCS are silently dropped by the NIC hardware and are usually not passed up to higher layers.

Many switches and network interface drivers keep counters of frames with FCS errors, which is useful for troubleshooting physical issues such as bad cables or interference.

CRC does not correct errors, it only detects them. Ethernet relies on upper layers, such as TCP, to handle retransmission if data is lost or corrupted.

Minimum and Maximum Frame Sizes

Because of the headers, payload, and FCS, Ethernet frames also have a minimum and maximum total size on the wire. Here we exclude preamble and SFD, which are handled at the physical level and often not counted when discussing frame size.

For standard Ethernet without optional tags:

Minimum frame size is:

• 6 bytes destination MAC
• 6 bytes source MAC
• 2 bytes EtherType
• 46 bytes payload
• 4 bytes FCS

So, the minimum frame is:
$$6 + 6 + 2 + 46 + 4 = 64 \text{ bytes}$$

Maximum frame size is:

• 6 bytes destination MAC
• 6 bytes source MAC
• 2 bytes EtherType
• 1500 bytes payload
• 4 bytes FCS

So, the maximum frame is:
$$6 + 6 + 2 + 1500 + 4 = 1518 \text{ bytes}$$

If an 802.1Q VLAN tag is present, it adds 4 bytes between the MAC addresses and the EtherType. With a tag, minimum and maximum frame sizes become 68 bytes and 1522 bytes respectively.

These limits were initially chosen to support collision handling and reliable detection in early shared Ethernet, even though modern switched Ethernet no longer relies on collisions. The limits remain part of the Ethernet standard and are crucial for interoperability.

Jumbo frames, which are not part of the original standard, increase the maximum frame size to values such as 9000 bytes, but every device on the path must support them or they will cause problems.

Interframe Gap

Although not part of the frame content, the interframe gap is a fixed period of idle time that separates successive Ethernet frames on the medium.

It is 12 bytes worth of time, expressed as 96 bit times. A bit time is the time it takes to send one bit at the current link speed. For example, at 100 Mbps, 1 bit time is 10 nanoseconds, so the interframe gap lasts 960 nanoseconds.

The purpose of the interframe gap is to give devices time to process received frames and prepare for the next one. It also helps preserve fairness and timing properties of the medium.

Because interframe gap bits are not part of the frame, they are not visible in packet captures or counted in frame sizes discussed earlier.

Typical Frame in a Packet Capture

When you open a frame in a protocol analyzer such as Wireshark, you generally see the fields from destination MAC down to FCS. Preamble, SFD, and interframe gap are usually absent.

A typical captured frame carrying an IPv4 packet without VLAN tagging might look like this in terms of order:

Destination MAC

Source MAC

EtherType = 0x0800 (IPv4)

IPv4 header

TCP or UDP header

Application data

FCS (sometimes stripped by the NIC and not shown)

If VLAN tagging is in use, you would see:

Destination MAC

Source MAC

VLAN tag:

Tag EtherType = 0x8100

VLAN information (including VLAN ID)

Inner EtherType, for example 0x0800

IPv4 header

...

Some NICs remove the FCS before passing the frame to the operating system, so in many captures you will see only up to the end of the payload.

Summary of Ethernet Frame Fields

To recap, here is a compact overview of the core fields inside a standard Ethernet frame as you will typically see them:

Everything above that, such as IP headers and TCP headers, lives inside the payload and belongs to higher layers. Everything below that, such as the preamble and interframe gap, belongs to the physical layer and timing.

With this structure in mind, you can move on to related topics such as MAC addressing behavior, switching, VLAN tagging, and detailed packet analysis, all of which build directly on the idea of Ethernet frames.