CCNA online course

Ethernet Frame Structure and Fields

Learn Ethernet frame structure, including MAC addresses, EtherType, VLAN tags, payload padding, FCS, frame sizes, switching, routing, and troubleshooting.

What Is an Ethernet Frame?

An Ethernet frame is the Layer 2 data unit used to carry upper-layer data across an Ethernet LAN. It wraps a Layer 3 packet, such as an IPv4 or IPv6 packet, with Ethernet addressing and error-detection information.

Encapsulation is the process of adding protocol-specific headers and trailers as data moves down the networking stack. A typical sequence is:

1. Application data is passed to a transport protocol, which creates a segment or datagram.
2. The network layer adds an IP header, creating an IP packet.
3. Ethernet adds a Layer 2 header and trailer, creating an Ethernet frame.
4. The physical layer transmits the frame as a sequence of bits represented by electrical, optical, or radio signals.

These terms describe different units:

• Segment: a transport-layer unit, commonly associated with TCP.
• Packet: a network-layer unit, such as an IP packet.
• Frame: a data-link-layer unit used for local delivery across a particular link.
• Bits: the binary values represented as signals on the physical medium.

Ethernet operation is standardized by the IEEE 802.3 family. Ethernet II is the widely deployed frame format that uses an EtherType value to identify the encapsulated protocol.

For background on how Ethernet fits into the networking stack, see the OSI reference model.

Ethernet Frame Layout

The fields appear in this order on the wire:

1. Preamble
2. Start Frame Delimiter (SFD)
3. Destination MAC address
4. Source MAC address
5. Optional IEEE 802.1Q VLAN tag
6. Type/Length field
7. Data and padding
8. Frame Check Sequence (FCS)

The destination and source MAC addresses, optional VLAN tag, Type/Length field, data, padding, and FCS are the conventional frame contents. The preamble and SFD are physical-layer transmission fields that prepare the receiver and mark the frame boundary. The header precedes the payload, and the FCS is the trailer that follows it.

Preamble and Start Frame Delimiter

The preamble is a 7-byte synchronization pattern. Receiving hardware uses it to align its timing and prepare to receive the frame.

The 1-byte Start Frame Delimiter (SFD) follows the preamble. It marks the point at which the destination MAC address begins.

The preamble and SFD total 8 bytes, but they are generally excluded from the conventional Ethernet frame-size calculation. The standard 64-byte minimum and 1518-byte maximum are measured from the destination MAC address through the FCS.

MAC Address Fields

A MAC address is a 48-bit Layer 2 address, normally written as six hexadecimal octets, such as 00:1A:2B:3C:4D:5E. Both the destination and source MAC fields are 6 bytes.

Destination MAC Address

The destination MAC address identifies the intended receiver on the local Ethernet segment or VLAN. It can identify:

• Unicast: one interface, such as a host or router interface.
• Broadcast: every host in the local broadcast domain. The IPv4 broadcast MAC address is FF:FF:FF:FF:FF:FF.
• Multicast: a subscribed group of receivers.

For a host sending to another host on the same subnet, the destination MAC is normally the other host's MAC address. For a remote IP destination, the host sends the frame to the MAC address of its default gateway. The router then forwards the packet toward the remote network.

Source MAC Address

The source MAC address identifies the Ethernet interface that transmitted the frame on that link. A switch uses the source address to learn which interface leads to that MAC address.

Type/Length Field

The 2-byte field after the source MAC address is called the Type/Length field because its interpretation depends on the framing convention.

Ethernet II and EtherType

In Ethernet II, the field is an EtherType: a protocol identifier that tells the receiver how to process the payload.

For example, an EtherType of 0x0800 causes the receiving device to pass the payload to IPv4 processing. An EtherType of 0x86DD causes IPv6 processing.

IEEE 802.3 Length Interpretation

In an IEEE 802.3 length-based frame, a value of 1500 or less specifies the length of the payload. The payload protocol is then identified through Logical Link Control (LLC), defined by IEEE 802.2. Some frames use SNAP, an extension that provides additional protocol identification.

Values from 1536 or greater are interpreted as EtherType values. The range between 1500 and 1536 is reserved for distinguishing these interpretations and is not treated as a normal protocol value.

Data and Padding

The data field carries the encapsulated Layer 3 packet or another upper-layer payload. In an untagged standard Ethernet frame, the combined data-and-pad area is normally 46 to 1500 bytes.

If the actual payload is shorter than 46 bytes, Ethernet adds padding bytes. Padding is not meaningful application data; it simply expands the payload area enough to satisfy the minimum frame size. The receiver uses the protocol information and length information to distinguish useful payload from padding where necessary.

Frame Check Sequence and CRC

The Frame Check Sequence (FCS) is a 4-byte trailer. The sender calculates a 32-bit Cyclic Redundancy Check (CRC) over the protected frame contents and places the result in the FCS field.

The receiver performs the same calculation. If its calculated value does not match the received FCS, the frame is considered corrupted and is discarded.

Ethernet Frame Size Rules

The standard minimum frame size is 64 bytes, measured from the destination MAC address through the FCS. The maximum untagged standard frame size is 1518 bytes, measured the same way.

The untagged calculation is:

14-byte header + 46-to-1500-byte data/pad + 4-byte FCS = 64-to-1518 bytes

A runt frame is smaller than the permitted minimum. A giant frame exceeds the expected maximum for the interface or network. A larger-than-standard jumbo frame can work only when the relevant devices and links consistently support the required maximum frame size.

802.1Q VLAN-Tagged Frames

An IEEE 802.1Q VLAN tag is an optional 4-byte insertion between the source MAC address and the Type/Length field.

• Tag Protocol Identifier (TPID): identifies the presence of an 802.1Q tag, commonly with the value 0x8100.
• Tag Control Information (TCI): contains VLAN identification and priority-related information. Conceptually, it includes the VLAN ID, priority bits, and a congestion-related indicator.

Tagged frames are commonly carried over switch trunk links, which transport traffic for multiple VLANs. Typical access-port traffic is untagged on the host-facing link; the switch associates it with the configured access VLAN.

See Configure trunk ports for Cisco IOS trunk configuration and verification.

Practical Frame Examples

IPv4 Ethernet II Frame

Suppose a host sends an IPv4 packet to a device on the same subnet. The frame might contain:

Destination MAC:  00:AA:BB:CC:DD:02  (local destination host)
Source MAC:       00:AA:BB:CC:DD:01  (sending host)
Type:             0x0800              (IPv4)
Data:             IPv4 packet
Pad:              Added if data is shorter than 46 bytes
FCS:              CRC calculated by the sender

If the IPv4 destination is on a remote subnet instead, the destination MAC in this first frame is the default gateway's MAC address, not the remote host's MAC address.

IPv6 Frame Identification

An IPv6 frame has the same core layout, but its Type field contains 0x86DD. The receiving device uses this value to pass the payload to IPv6 processing.

ARP Broadcast Frame

An ARP request commonly uses:

Destination MAC:  FF:FF:FF:FF:FF:FF  (broadcast)
Source MAC:       Sender's MAC address
Type:             0x0806              (ARP)
Data:             ARP request

A switch floods a broadcast frame to other ports in the same VLAN, except the port on which it arrived. Hosts inspect the ARP payload and respond when appropriate.

VLAN-Tagged Frame on a Trunk

A tagged frame has this order around the addressing and protocol fields:

Destination MAC | Source MAC | TPID/TCI VLAN tag | Type/Length | Data | FCS

For example, the TCI can identify VLAN 20. The 4-byte tag increases the conventional maximum from 1518 bytes to 1522 bytes.

How Switches and Routers Handle Frames

Switch Forwarding

A switch examines the source and destination MAC addresses. It learns the source MAC address and the ingress interface, then uses its MAC address table to decide what to do with the frame:

• Forward: send it out the interface associated with the destination MAC.
• Filter: do not send it to an interface when the destination is known to be on the same incoming segment.
• Flood: send it through relevant ports when the destination is unknown or is broadcast or multicast traffic.

Routing Between Ethernet LANs

A router does not forward the incoming Ethernet frame unchanged. It removes the incoming Ethernet header and FCS, processes the Layer 3 packet, and creates a new Ethernet frame for the outbound interface.

For example, a PC sending to a remote subnet uses a frame addressed to the router's local MAC address. After routing, the outbound frame uses the router's outgoing-interface MAC address as its source and the next-hop device's MAC address as its destination. A new FCS is calculated for the new frame.

Source and destination MAC addresses commonly change at every routed hop, while the source and destination IP addresses normally remain the same end-to-end, aside from features such as address translation.

A router-on-a-stick design uses an 802.1Q trunk between a switch and router. See Configure router on a stick for a related configuration example.

Relationship to Physical Ethernet Operation

Ethernet frames cross the medium as a sequence of bits represented by physical signals. The interframe gap is the required idle interval between frame transmissions. It is not a field inside the frame and is not included in the 64-to-1518-byte measurement.

Modern Ethernet normally operates in full-duplex mode. Each endpoint can transmit and receive simultaneously, so collisions are not expected on a properly configured switched full-duplex link. Legacy shared Ethernet used half-duplex operation and collision detection. The 64-byte minimum helped ensure that a transmitting station was still sending when a collision could propagate back across the shared medium.

Inspecting Ethernet Frames and Interface Counters

Cisco IOS Interface Checks

Use these commands to inspect addressing, link status, frame-related errors, and switch MAC learning:

show interfaces <interface>
show interfaces <interface> counters errors
show mac address-table

In the output, pay attention to the interface MAC address, speed, duplex, input errors, CRC errors, runts, and giants. The MAC address table shows the switch's learned source locations.

Verifying an 802.1Q Trunk

interface <interface>
switchport mode trunk
switchport trunk allowed vlan <vlan-list>
show interfaces trunk

Use the verification output to check tagged VLAN traffic, allowed VLANs, and native VLAN behavior. Native VLAN traffic is commonly transmitted untagged, while other VLANs on the trunk are tagged.

Packet Capture

Packet capture tools can expose destination MAC, source MAC, EtherType, and VLAN information:

Wireshark display filter: eth
Wireshark display filter: eth.type == 0x0800
Wireshark display filter: vlan
tcpdump -e -nn -i <interface>

Captures do not always include the physical preamble, SFD, or FCS. Network interface hardware may remove these fields before delivering the captured packet to the operating system, so their absence in a capture does not necessarily mean they were absent on the wire.

Troubleshooting Frame Problems

CRC or FCS Errors

Increasing CRC or FCS errors mean received frames are failing the integrity check and being discarded. Common causes include damaged cabling, connector or transceiver faults, electrical interference, faulty NICs or switch ports, and duplex mismatches on legacy or improperly negotiated links.

1. Review interface error counters.
2. Check speed, duplex, and negotiation status.
3. Test or replace the cable and optics.
4. Move the connection to a known-good port when appropriate.

Runt Frames

Runt frames are smaller than the standard 64-byte minimum. Possible causes include legacy half-duplex collisions, physical-layer corruption, and faulty hardware. Confirm whether the link is full duplex, review collision and late-collision counters where available, and test the physical connection.

Giant or Oversized Frames

Giant frames or oversized-frame drops can result from inconsistent jumbo-frame settings, unexpected encapsulation overhead, or an incorrect interface MTU or maximum-frame-size configuration.

1. Compare MTU and maximum-frame-size settings across the path.
2. Account for VLAN and other encapsulation overhead.
3. Confirm the platform-specific frame-size limit on each device.

Remote Subnet Is Unreachable

If a host has an IP route but cannot reach a remote subnet, inspect ARP entries and captures. For an off-subnet destination, the outbound Ethernet destination MAC should normally be the default gateway's MAC. Also verify switch MAC learning, VLAN membership, and gateway-interface status.

Exam-Relevant Summary

• An Ethernet frame is a Layer 2 encapsulation unit; an IP packet is a Layer 3 unit.
• The preamble is 7 bytes and the SFD is 1 byte; together they total 8 bytes and are normally excluded from frame-size calculations.
• Destination and source MAC addresses are each 6 bytes.
• The standard untagged frame is 64 to 1518 bytes from destination MAC through FCS.
• The untagged header is 14 bytes, the data-and-pad area is 46 to 1500 bytes, and the FCS is 4 bytes.
• An 802.1Q tag adds 4 bytes and raises the conventional maximum to 1522 bytes.
• EtherType values identify protocols in Ethernet II. Common values are IPv4 0x0800, ARP 0x0806, IPv6 0x86DD, and VLAN tagging 0x8100.
• Values of 1500 or less can represent payload length in IEEE 802.3 framing; values of 1536 or greater are interpreted as EtherType values.
• FCS uses a CRC to detect corruption; it does not correct errors or normally retransmit frames.
• A switch forwards frames using MAC addresses, while a router removes and rebuilds the Layer 2 frame at each routed hop.
• For remote IP destinations, the first Ethernet destination is normally the default gateway's MAC, not the remote host's MAC.
• The interframe gap is idle time between frames, not a frame field.