Ethernet Frames

An ethernet frame is a literal envelope: an address on the front, a return address on the back, and something sealed inside.

Frame Structure

10101010 10101010 10101010 10101010 10101010 10101010 10101010 10101011

52:54:00:03:5b:88

52:54:00:09:84:f1

0x0806

77 52 28 f7 97 cc 07 bd 09 55 78 bb b0 a6 36 34 d1 da 15 f7 26 8b ec 7e 7b c6 ae 07 3d 6b 56 3b 9c ba cb 64 fb f9 e3 b0 55 fd a9 7f e7 27

6a 1a da e1

Example Frame

ff:ff:ff:ff:ff:ff  b8:27:eb:12:34:56  0806  <payload…>
        ↑                  ↑            ↑
        │                  │            └─ EtherType: 0x0806 = ARP
        │                  └────────────── Source MAC (b8:27:eb = Raspberry Pi OUI)
        └───────────────────────────────── Destination MAC (broadcast)

Breaking it down:

• Destination MAC (6 bytes): ff:ff:ff:ff:ff:ff
  • All bits set is the broadcast address — every host on the LAN receives it
• Source MAC (6 bytes): b8:27:eb:12:34:56
  • First 3 bytes are the OUI (Organizationally Unique Identifier, a vendor prefix), last 3 identify the NIC (Network Interface Card)
• EtherType (2 bytes): 0806
  • Identifies the protocol inside the payload
• Payload (46–1500 bytes): the packet handed down from the layer above

MAC Address Bits

The two lowest bits of the first byte flag two properties:

The broadcast ff:ff:ff:ff:ff:ff is a multicast with every bit set.

Common EtherTypes

When the EtherType is 0x8100, a 4-byte VLAN tag sits between the source MAC and the real EtherType. Paste a VLAN-tagged frame into the explorer above and the extra field appears automatically.

How big can a frame get?

Every link has a ceiling on how much payload it’ll carry. On standard ethernet that’s 1500 bytes, the MTU (Maximum Transmission Unit).

Jumbo frames are payloads above 1500, typically up to around 9000 bytes. They cut per-frame overhead, but only work in controlled networks like data centres where the operator has configured every hop to carry them.

Bytes you never see

Every frame on the wire is bracketed by bytes software never sees.

Before the frame, the NIC sends seven bytes of preamble, alternating 10101010 bits, followed by a one-byte Start Frame Delimiter (SFD) of 0xd5. The alternating pattern lets the receiver’s clock lock onto the sender’s bit rate; the SFD’s final 11 bits break the pattern to mark where the real frame begins.

After the frame, the NIC appends a 4-byte Frame Check Sequence (FCS), a CRC-32 computed over the header and payload. The sender writes it; the receiver verifies and strips it. If the check fails, from a bad cable, a dirty optic, or electrical noise on the line, the frame is silently dropped in hardware.

Both ends are pure NIC work. By the time the kernel has a frame, the preamble has done its job and the FCS has already passed or failed. The FCS isn’t cryptographic; it catches accidents, not adversaries.

Frame Sizes

A standard ethernet frame on the wire ranges from 64 bytes (14 header + 46 padded payload + 4 FCS) to 1518 bytes (14 + 1500 + 4). Jumbo frames go up to around 9018 bytes.

References

• IEEE 802.3: Ethernet Standard
• IANA EtherType Registrations
• Wikipedia: Ethernet frame