Ethernet Frame Structure Essentials

Why This Matters

Every time data moves across a local network, it travels inside an Ethernet frame: a carefully structured container that ensures bits arrive at the right destination, in the right order, and without corruption. Understanding frame structure isn't just about memorizing field sizes; it's about grasping the fundamental challenges of network communication: synchronization, addressing, protocol multiplexing, error detection, and traffic management. These concepts appear throughout networking, from link-layer protocols to higher-level troubleshooting scenarios.

You're being tested on your ability to explain why each field exists and how the frame structure solves real engineering problems. When you see a question about frame formats, don't just recall that the FCS is 4 bytes. Know that it enables error detection through CRC, and understand when that check happens in the receiving process. Master the reasoning behind the structure, and the details will stick.

---

Synchronization and Frame Boundaries

Before any meaningful data can be exchanged, the sender and receiver must agree on timing. These fields solve the fundamental problem of clock synchronization between independent devices and mark where frames begin and end.

Preamble

• 7 bytes of alternating 1s and 0s (10101010...) that allow the receiver's clock to lock onto the sender's bit timing before actual data arrives
• Acts as a clock synchronization mechanism that compensates for slight timing differences between network interfaces
• Reduces bit errors by giving the receiver's phase-locked loop (PLL) circuitry time to stabilize before processing frame contents

Start Frame Delimiter (SFD)

• 1-byte field with the value 10101011. That final "11" breaks the alternating pattern, signaling that real frame data follows immediately
• Marks the precise boundary between synchronization bits and the frame header
• Without the SFD, receivers couldn't distinguish preamble from the start of the actual frame

Interframe Gap

• 96 bit times of silence required between consecutive frames, giving receivers time to process one frame before the next arrives
• Prevents receiver overload by ensuring hardware can complete frame processing and buffer management
• All transmitters must respect this minimum spacing, which also supports fair channel access

---

Addressing and Delivery

Ethernet operates on shared or switched media where multiple devices coexist. These address fields solve the problem of identifying who sent a frame and who should receive it.

Destination MAC Address

• 6-byte hardware address identifying the intended recipient. Switches use this field to forward frames out the correct port.
• Three address types exist: unicast (single device), multicast (group of devices), and broadcast (all devices on the LAN, using FF:FF:FF:FF:FF:FF).
• The first byte contains bits that distinguish locally administered from universally administered addresses, and unicast from multicast. Specifically, the least significant bit of the first byte is the I/G (Individual/Group) bit: 0 for unicast, 1 for multicast/broadcast. The second-least significant bit is the U/L (Universal/Local) bit: 0 for universally administered (OUI-assigned), 1 for locally administered.

Source MAC Address

• 6-byte address identifying the sender. This is always a unicast address (never broadcast or multicast).
• Enables switch learning: switches build their MAC address tables by recording which source addresses appear on which ports.
• Supports response routing so replies can find their way back to the originating device.

---

Protocol Identification and Payload

Once a frame reaches the right device, the receiving stack must know what to do with the contents. The EtherType field and payload work together to multiplex multiple protocols over a single link layer.

EtherType/Length Field

This 2-byte field has a dual interpretation depending on its value:

• Values ≤ 1500 indicate the payload length (IEEE 802.3 semantics).
• Values ≥ 1536 (0x0600) indicate the protocol type of the encapsulated data (Ethernet II semantics).

The gap between 1500 and 1536 is intentional and avoids ambiguity between the two interpretations.

Common EtherType values worth memorizing:

• 0x0800 = IPv4
• 0x86DD = IPv6
• 0x0806 = ARP

This field enables protocol demultiplexing: the NIC and OS know whether to pass the payload to the IP stack, the ARP handler, or another protocol module.

Payload (Data)

• Variable-length field carrying the encapsulated packet from higher layers (typically an IP datagram)
• Size constraints: minimum 46 bytes, maximum 1500 bytes (standard MTU). If the upper-layer data is smaller than 46 bytes, padding is added to meet the minimum.
• Everything else in the frame exists to deliver this field successfully.

---

Error Detection and Integrity

Networks are inherently unreliable: bits flip, signals degrade, and interference corrupts data. The FCS field provides a mathematical check that detects transmission errors.

Frame Check Sequence (FCS)

• 4-byte CRC-32 value computed over the frame contents from the destination MAC address through the end of the payload. The receiver recalculates the CRC and compares it to the received FCS.
• Detects errors but does not correct them. Corrupted frames are silently discarded at Layer 2, leaving error recovery to higher-layer protocols like TCP.
• Computed in hardware by the NIC for speed. The CRC calculation covers all fields except the preamble, SFD, and the FCS itself.

---

Frame Size Constraints

Ethernet defines strict size limits that balance collision detection requirements with transmission efficiency.

Minimum and Maximum Frame Sizes

• Minimum 64 bytes (destination MAC + source MAC + EtherType + payload + FCS). This minimum exists because in classic CSMA/CD Ethernet, a frame must be long enough that the sender is still transmitting when a collision signal propagates back from the farthest point on the network. If the frame were shorter, the sender might finish transmitting before detecting the collision, making the collision undetectable.
• Maximum 1518 bytes standard (1522 with a VLAN tag). This upper limit prevents any single device from monopolizing the shared medium for too long.
• Jumbo frames (up to ~9000 bytes) are used in data center environments to reduce per-frame overhead and improve throughput, but they are not part of the IEEE standard and require explicit configuration on all devices in the path.

---

Traffic Segmentation

Modern networks need logical separation without physical rewiring. VLAN tagging adds virtual network boundaries within the frame structure itself.

VLAN Tagging (802.1Q)

A 4-byte tag is inserted between the source MAC address and the EtherType/Length field. It contains:

• TPID (Tag Protocol Identifier): 2 bytes set to 0x8100, which tells the receiver this is a tagged frame.
• TCI (Tag Control Information): 2 bytes containing a 3-bit PCP (Priority Code Point) for QoS, a 1-bit DEI (Drop Eligible Indicator), and a 12-bit VLAN ID.

The 12-bit VLAN ID supports up to 4094 usable VLANs (IDs 1 through 4094; 0 and 4095 are reserved). The tag increases the maximum frame size to 1522 bytes without reducing the available payload.

---

Quick Reference Table

---

Self-Check Questions

1. Which two fields work together to establish timing before frame data arrives, and what specific bit pattern signals the transition between them?

2. A switch receives a frame and needs to update its MAC address table. Which field does it examine, and why can't it use the other address field for this purpose?

3. Compare the FCS field with TCP's checksum. What does each protect, and what happens when each detects an error?

4. Why does Ethernet enforce a minimum frame size of 64 bytes? How does this relate to collision detection in CSMA/CD networks?

5. An Ethernet frame arrives with an EtherType value of 0x0806. What protocol is encapsulated, and how would the receiving host handle this differently than a frame with EtherType 0x0800?