Understanding the Ethernet Frame Header (Layer 2)
The Ethernet frame header operates at Layer 2 (Data Link Layer) of the OSI model and is essential for local network communication. It contains metadata that enables devices to identify, route, and validate data on the same network segment. Without this header structure, devices couldn't determine the intended recipient, detect transmission errors, or properly process incoming data.
Key Points
- Primary Functions: Enables framing, MAC-based addressing, and error detection for local network transmission
- Core Components: Preamble, destination/source MAC addresses, EtherType field, payload, and Frame Check Sequence (FCS)
- Error Detection: Uses CRC-32 checksums to detect corruption but does not correct errors or retransmit frames
- Protocol Identification: The EtherType field specifies which Layer 3 protocol (IPv4, IPv6, ARP) is encapsulated in the payload
- Best-Effort Delivery: Ethernet provides no delivery guarantees; reliability is handled by higher-layer protocols like TCP
Ethernet Frame Structure
Preamble and Start Frame Delimiter
Preamble: 7 bytes of alternating 1s and 0s (10101010...)
Start Frame Delimiter (SFD): 1 byte (10101011)
Purpose:
- Synchronizes sender and receiver clock signals
- Alerts receiving devices that a frame is arriving
- Establishes bit-level timing for proper signal interpretation
Note: The preamble and SFD are not part of the frame header or payload—they exist at the physical signaling level and are typically stripped by network interface cards before processing.
MAC Addresses
Destination MAC Address (6 bytes): Identifies the intended recipient device
Source MAC Address (6 bytes): Identifies the sending device
How MAC filtering works:
- Network interface cards examine the destination MAC address first
- Frames are discarded immediately if the destination MAC doesn't match the device's own address, a broadcast address (
FF:FF:FF:FF:FF:FF), or a subscribed multicast address - This filtering occurs before any higher-layer processing, reducing CPU overhead
EtherType Field
A 2-byte field that identifies the Layer 3 protocol encapsulated in the payload.
| EtherType Value | Protocol |
|---|---|
0x0800 | IPv4 |
0x86DD | IPv6 |
0x0806 | ARP (Address Resolution Protocol) |
0x8100 | 802.1Q VLAN-tagged frame |
0x88E5 | MACsec (encrypted Ethernet) |
The receiving device uses this field to determine which protocol handler should process the payload.
Payload
Size: 46 to 1500 bytes
Contents: Layer 3 and higher protocol data (IP packets, TCP segments, application data)
Important characteristics:
- Minimum payload is 46 bytes; smaller payloads are padded to meet Ethernet's 64-byte minimum frame size
- Layer 2 devices do not interpret payload contents—they simply forward it to the appropriate protocol based on EtherType
- Maximum Transmission Unit (MTU) of 1500 bytes is standard, though jumbo frames can extend this
Frame Check Sequence (FCS)
A 4-byte field containing a CRC-32 checksum for error detection.
How it works:
- Sender: Calculates CRC-32 over the entire frame (excluding preamble/SFD) and appends the result as the FCS
- Receiver: Recalculates CRC-32 on the received frame and compares it to the FCS value
- Match: Frame is accepted and passed to higher layers
- Mismatch: Frame is silently discarded with no notification to the sender
Critical limitations:
- Only detects errors—does not correct them
- Corrupted frames are dropped at Layer 2 with no automatic retransmission
- Higher-layer protocols (TCP, application-level acknowledgments) must handle recovery
Complete Frame Layout
+----------+-----+----------+----------+----------+---------+-----+
| Preamble | SFD | Dest MAC | Src MAC | EtherType| Payload | FCS |
| (7 bytes)|(1B) | (6 bytes)|(6 bytes) | (2 bytes)|(46-1500)|(4B) |
+----------+-----+----------+----------+----------+---------+-----+
Total frame size: 64 to 1518 bytes (excluding preamble and SFD)
How Ethernet Frames Work: Practical Example
Scenario: Sending an HTTP Request on a Local Network
Step 1 - Application Layer: Browser initiates request to https://example.com
Step 2 - Transport Layer: TCP segments the data and adds port information
Step 3 - Network Layer: IP encapsulates TCP segments into an IP packet with source/destination IP addresses
Step 4 - Data Link Layer: Ethernet frame is constructed:
- Destination MAC: Router's MAC address (obtained via ARP if the destination IP is outside the local subnet)
- Source MAC: Sender's network interface MAC address
- EtherType:
0x0800(indicating IPv4 payload) - Payload: The complete IP packet
- FCS: CRC-32 checksum calculated over the frame
Step 5 - Physical Layer: Frame is converted to electrical, optical, or radio signals and transmitted
Step 6 - Receiver Processing:
- Checks destination MAC—discards if it doesn't match
- Validates FCS—discards if checksum fails
- Examines EtherType to determine which Layer 3 protocol handler to invoke
- Passes payload to the IP layer for further processing
Common Misconceptions
Myth: "The FCS corrects transmission errors"
Reality: FCS only detects errors through checksum validation. Corrupted frames are simply dropped—no automatic correction or retransmission occurs at Layer 2.
Myth: "Ethernet guarantees reliable delivery"
Reality: Ethernet is a best-effort protocol. Frames can be lost due to collisions, corruption, or buffer overflows. Reliability must be implemented at higher layers (TCP provides this at Layer 4).
Additional clarifications:
- Preamble vs. Header: The preamble is for physical-layer synchronization and is not part of the frame's header structure
- EtherType vs. Port Numbers: EtherType identifies Layer 3 protocols (IPv4, IPv6), while port numbers (found in TCP/UDP headers) identify Layer 4 services
- Minimum Frame Size: Ethernet requires 64 total bytes (18-byte header + 46-byte minimum payload). Smaller payloads are automatically padded with zeros
Error Detection Process
SENDER SIDE:
Frame Data → CRC-32 Calculation → Append FCS → Transmit
RECEIVER SIDE:
Received Frame → CRC-32 Recalculation → Compare with FCS
|
├─ Match → Accept & Forward
└─ Mismatch → Silently Drop
Learn More
Advanced Ethernet Technologies
VLAN Tagging (802.1Q)
Adds a 4-byte tag between the source MAC and EtherType fields to support virtual LANs:
+----------+----------+----------+----------+---------+-----+
| Dest MAC | Src MAC | 802.1Q | EtherType| Payload | FCS |
| (6 bytes)|(6 bytes) | (4 bytes)|(2 bytes) |(46-1500)|(4B) |
+----------+----------+----------+----------+---------+-----+
The 802.1Q tag includes:
- VLAN ID: Identifies which virtual LAN the frame belongs to (0-4095)
- Priority: Quality of Service (QoS) priority level
Jumbo Frames