Ethernet Frame
In this post, I will cover the structure of an 802.3 Ethernet Frame and break down each of its components.
The structure of an Ethernet frame is specified in the IEEE 802.3 standard. A basic IEEE 802.3 frame structure looks like this:
Preamble:
The preamble informs the receiving station that a frame is about to begin. It also allows for a small amount of loss while the signal begins propagating across the media without affecting the actual data transmission. The preamble bit values alternate between 1 and 0, allowing the receiver to synchronize its clock with the transmitter.
The wired bit pattern that is transmitted in the preamble will look like this:
10101010 10101010 10101010 10101010 10101010 10101010 10101010
Start Frame Delimeter (SFD):
The Start Frame Delimiter breaks the pattern in the preamble to signal the start of the actual Ethernet frame. The SFD will end with 1 instead of 0:
10101011
Destination Address (DA):
The destination address immediately follows the SFD. The destination address field contains one of the following three addresses:
a 48-bit MAC address of the network interface card (NIC) in the device that is the destination of the frame
a 48-bit multicast address
a broadcast address (FF:FF:FF:FF:FF:FF)
All receiving stations will read the destination address to determine if the frame is destined for that device. If it is, it will accept it. If the frame is not addressed for that device, it will drop the frame.
Source Address (SA):
The source address field contains the 48-bit MAC address of the device that sent the frame. This address will always be a unicast address. A switch uses the source address to build its MAC address table, mapping known MAC addresses to the interface where the device is plugged in.
Type or Length:
The type or length field (EtherType) indicates the type of protocol data being carried in the frame's data payload or the size of the Ethernet Frame. If the value is less than or equal to 1500 (0x5DC), the field indicates the length of the payload. If the value is greater than 1536 (0x600), the field indicates the type of protocol that is encapsulated in the frame.
Here is a list of common EtherTypes that you may see when capturing network traffic:
IPv4 = 0x0800
IPv6 = 0x86DD
ARP = 0x0806
Data:
The data field contains the actual data that needs to be transmitted. It is a variable-length field that allows for 46-1500 bytes of information to be transmitted across the wire. If the data to be transmitted is less than 46 bytes, padding is added to increase its size to the minimum required.
Frame Check Sequence:
The Frame Check Sequence (FCS) is used to check the integrity of the frame and to detect any transmission errors that may have occurred during the delivery of the frame. The FCS is calculated separately by both the sending and the receiving stations. The receiving station calculates the value and compares it to the value that the receiving station included in the FCS field. If the values are identical, the receiving station will assume that there were no errors during transmission. The receiving device will discard the frame if the values do not match.
Minimum and Maximum Frame Sizes:
A basic Ethernet frame transmitting the maximum size of data (1500 bytes) will result in a frame that is 1518 bytes. This does not include the preamble. The minimum frame size allowed is 64 bytes. There is a concept known as Jumbo frames, but that is outside the scope of an associate-level engineer.
One last note. An Ethernet frame can have an optional field that includes a VLAN tag, which we will cover in a later post when we get into VLANs and 802.1Q trunking.
I hope this post helps you understand the structure and components of Ethernet frames.