Understanding the Ethernet Frame Header (Layer 2)

Ethernet frame headers operate at the Data Link Layer (Layer 2) of the OSI model, enabling devices to communicate within a local network. They provide critical metadata for addressing, protocol identification, and error detection, ensuring data reaches the correct recipient and arrives intact. Without this structure, devices couldn’t route traffic, detect corruption, or process incoming data efficiently.

---

Key Functions of Ethernet Frame Headers

• Framing: Encapsulates data into structured units for transmission.
• MAC Addressing: Uses source and destination MAC addresses to identify devices on the same network segment.
• Protocol Identification: The EtherType field specifies which Layer 3 protocol (e.g., IPv4, IPv6) is encapsulated in the payload.
• Error Detection: The Frame Check Sequence (FCS) uses a CRC-32 checksum to detect corruption but does not correct errors.
• Best-Effort Delivery: Ethernet provides no guarantees; reliability is handled by higher-layer protocols like TCP.

---

Ethernet Frame Structure Breakdown

1. Preamble and Start Frame Delimiter (SFD)

Preamble (7 bytes):

• Alternating 1s and 0s (10101010...) to synchronize sender/receiver clocks.

Start Frame Delimiter (SFD) (1 byte):

• 10101011 marks the start of the frame.

Note: The preamble and SFD are stripped by network interface cards (NICs) before processing—they are not part of the frame header or payload.

---

2. MAC Addresses

Destination MAC Address (6 bytes):

• Identifies the intended recipient. Frames are discarded if the address doesn’t match the device’s own MAC, a broadcast address (FF:FF:FF:FF:FF:FF), or a subscribed multicast address.

Source MAC Address (6 bytes):

• Identifies the sending device.

How MAC Filtering Works:

• NICs check the destination MAC first.
• Mismatches trigger immediate discarding, reducing CPU overhead.

---

3. EtherType Field

A 2-byte field that specifies the encapsulated Layer 3 protocol.

EtherType Value	Protocol
0x0800	IPv4
0x86DD	IPv6
0x0806	ARP
0x8100	VLAN-tagged frame
0x88E5	MACsec (encrypted)

---

4. Payload

• Size: 46 to 1500 bytes (minimum 46 bytes; smaller payloads are padded).
• Contents: Layer 3+ data (e.g., IP packets, TCP segments).
• MTU: Standard 1500 bytes (jumbo frames can exceed this).

Key Point: Layer 2 devices forward payloads without interpreting them.

---

5. Frame Check Sequence (FCS)

• 4-byte CRC-32 checksum for error detection.
• Process:
  1. Sender calculates CRC-32 over the frame (excluding preamble/SFD) and appends it.
  2. Receiver recalculates CRC-32 and compares it to the FCS.
  3. Match: Frame is accepted.
  4. Mismatch: Frame is silently discarded.

Limitation: FCS detects errors but does not correct them or trigger retransmission.

---

Complete Frame Layout

+----------+-----+----------+----------+----------+---------+-----+
| Preamble | SFD | Dest MAC | Src MAC  | EtherType| Payload | FCS |
| (7B)     | (1B)| (6B)     | (6B)     | (2B)     | (46-1500B)| (4B)|
+----------+-----+----------+----------+----------+---------+-----+

Total frame size: 64 to 1518 bytes (excluding preamble/SFD).

---

Practical Example: HTTP Request Workflow

1. Application Layer: Browser sends a request to https://example.com.
2. Transport Layer: TCP segments the data.
3. Network Layer: IP encapsulates segments into a packet.
4. Data Link Layer:
   • Destination MAC: Router’s MAC (via ARP if external).
   • Source MAC: Sender’s NIC MAC.
   • EtherType: 0x0800 (IPv4).
   • Payload: IP packet.
   • FCS: CRC-32 checksum.
5. Physical Layer: Frame is transmitted as signals.
6. Receiver Processing:
   • Checks destination MAC and FCS.
   • Uses EtherType to route the payload to the IP layer.

---

Common Misconceptions

Myth: "FCS corrects errors." Reality: FCS only detects errors; corrupted frames are dropped.

Myth: "Ethernet guarantees delivery." Reality: It’s a best-effort protocol; reliability requires higher layers (e.g., TCP).

Clarifications:

• Preamble ≠ Header: The preamble is for physical-layer sync.
• EtherType ≠ Port Numbers: EtherType identifies Layer 3 protocols; ports identify Layer 4 services.
• Minimum Frame Size: 64 bytes (18-byte header + 46-byte payload).

---

Error Detection Process

SENDER: Frame Data → CRC-32 → Append FCS → Transmit
RECEIVER: Frame → CRC-32 → Compare FCS → Accept/Drop

---

Learn More

Advanced Ethernet Technologies

1. VLAN Tagging (802.1Q)

• Adds a 4-byte tag between source MAC and EtherType.
• Includes VLAN ID (0–4095) and QoS priority.

2. Jumbo Frames

• Payloads up to 9000 bytes (vs. standard 1500-byte MTU).
• Benefits: Reduced overhead for large data transfers (e.g., storage networks).

3. MACsec (802.1AE)

• Encrypts Ethernet frames at Layer 2 for security.
• Uses EtherType 0x88E5 to identify encrypted traffic.