Ethernet Frame Structure Essentials

Why This Matters

Every time data moves across a local network, it travels inside an Ethernet frame—a carefully structured container that ensures bits arrive at the right destination, in the right order, and without corruption. Understanding frame structure isn't just about memorizing field sizes; it's about grasping the fundamental challenges of network communication: synchronization, addressing, protocol multiplexing, error detection, and traffic management. These concepts appear throughout networking, from link-layer protocols to higher-level troubleshooting scenarios.

You're being tested on your ability to explain why each field exists and how the frame structure solves real engineering problems. When you see a question about frame formats, don't just recall that the FCS is 4 bytes—know that it enables error detection through CRC, and understand when that check happens in the receiving process. Master the reasoning behind the structure, and the details will stick.

---

Synchronization and Frame Boundaries

Before any meaningful data can be exchanged, the sender and receiver must agree on timing. These fields solve the fundamental problem of clock synchronization between independent devices and mark where frames begin and end.

Preamble

• 7 bytes of alternating 1s and 0s (101010...)—allows the receiver's clock to lock onto the sender's bit timing before actual data arrives
• Clock synchronization mechanism that compensates for slight timing differences between network interfaces
• Reduces bit errors by giving the receiver time to stabilize before processing frame contents

Start Frame Delimiter (SFD)

• 1-byte field with value 10101011—the final "11" breaks the alternating pattern, signaling that real data follows immediately
• Marks the precise boundary between synchronization bits and the frame header
• Critical for frame detection—without it, receivers couldn't distinguish preamble from payload

Interframe Gap

• 96 bit times of silence required between consecutive frames—gives receivers time to process one frame before the next arrives
• Prevents receiver overload by ensuring hardware can complete frame processing and buffer management
• Defines minimum spacing that all transmitters must respect, enabling fair channel access

---

Addressing and Delivery

Ethernet operates on shared or switched media where multiple devices coexist. These address fields solve the problem of identifying who sent a frame and who should receive it.

Destination MAC Address

• 6-byte hardware address identifying the intended recipient—switches use this to forward frames out the correct port
• Three address types: unicast (single device), multicast (group), or broadcast (all devices, using FF:FF:FF:FF:FF:FF)
• Locally administered vs. universally administered addresses distinguished by specific bits in the first byte

Source MAC Address

• 6-byte address identifying the sender—always a unicast address (never broadcast or multicast)
• Enables switch learning—switches build MAC address tables by recording which source addresses appear on which ports
• Supports response routing so replies can find their way back to the originating device

---

Protocol Identification and Payload

Once a frame reaches the right device, the receiving stack must know what to do with the contents. The EtherType field and payload work together to multiplex multiple protocols over a single link layer.

EtherType/Length Field

• 2-byte field with dual interpretation—values ≤ 1500 indicate payload length (IEEE 802.3), values ≥ 1536 indicate protocol type (Ethernet II)
• Common EtherType values: 0x0800 for IPv4, 0x86DD for IPv6, 0x0806 for ARP—memorize these for quick identification
• Enables protocol demultiplexing so the NIC knows whether to pass payload to IP stack, ARP handler, or other protocol

Payload (Data)

• Variable-length field carrying the encapsulated packet from higher layers (typically IP datagrams)
• Size constraints: minimum 46 bytes, maximum 1500 bytes (standard MTU)—smaller payloads require padding
• Contains the actual information being communicated; everything else in the frame exists to deliver this successfully

---

Error Detection and Integrity

Networks are inherently unreliable—bits flip, signals degrade, and interference corrupts data. The FCS field provides a mathematical check that detects transmission errors.

Frame Check Sequence (FCS)

• 4-byte CRC-32 value computed over the entire frame (from destination MAC through payload)—receiver recalculates and compares
• Detects errors but doesn't correct them—corrupted frames are silently discarded, leaving recovery to higher layers
• Computed in hardware by the NIC for speed; covers all fields except preamble, SFD, and the FCS itself

---

Frame Size Constraints

Ethernet defines strict size limits that balance collision detection requirements with transmission efficiency.

Minimum and Maximum Frame Sizes

• Minimum 64 bytes (including header and FCS)—ensures frames are long enough for collision detection in CSMA/CD networks
• Maximum 1518 bytes standard (1522 with VLAN tag)—limits how long one device can occupy the shared medium
• Jumbo frames (up to 9000 bytes) exist but aren't standardized—used in data centers to reduce per-frame overhead

---

Traffic Segmentation

Modern networks need logical separation without physical rewiring. VLAN tagging adds virtual network boundaries within the frame structure itself.

VLAN Tagging (802.1Q)

• 4-byte tag inserted after source MAC address—contains TPID (0x8100), priority bits, and 12-bit VLAN ID
• Supports up to 4094 VLANs (VLAN IDs 1-4094; 0 and 4095 reserved)—enables logical network segmentation on shared infrastructure
• Increases maximum frame size to 1522 bytes—the extra 4 bytes accommodate the tag without reducing payload capacity

---

Quick Reference Table

---

Self-Check Questions

1. Which two fields work together to establish timing before frame data arrives, and what specific bit pattern signals the transition between them?

2. A switch receives a frame and needs to update its MAC address table. Which field does it examine, and why can't it use the other address field for this purpose?

3. Compare and contrast the FCS field with TCP's checksum—what does each protect, and what happens when each detects an error?

4. Why does Ethernet enforce a minimum frame size of 64 bytes? How does this relate to collision detection in CSMA/CD networks?

5. An Ethernet frame arrives with an EtherType value of 0x0806. What protocol is encapsulated, and how would the receiving host handle this differently than a frame with EtherType 0x0800?