VMware ESXi and vSphere Cluster Management

Ethernet Frame Structure: Header, Payload, and FCS

Learn Ethernet frame structure, including the preamble, SFD, MAC addresses, EtherType, payload, padding, FCS, and standard frame size limits.

An Ethernet frame is the Layer 2, or network access layer, data unit used to carry information across an Ethernet link. It contains local delivery addresses, a field describing the carried protocol, the higher-layer data, and an error-detection trailer.

Ethernet framing is part of encapsulation: a process in which each networking layer adds protocol information around data from the layer above. For example, an application message can become part of a transport segment, which becomes part of an IP packet, which is then placed inside an Ethernet frame.

What Is an Ethernet Frame?

An Ethernet frame carries an IPv4 packet, IPv6 packet, ARP message, or another supported payload across one local Ethernet link. Ethernet provides local delivery. IP provides logical addressing and routing between different networks.

The frame has three broad parts:

• Header: destination MAC address, source MAC address, and the Type/Length field.
• Payload area: the Data and Pad field, which carries the encapsulated upper-layer information.
• Trailer: the Frame Check Sequence, or FCS, used for error detection.

The preamble and Start Frame Delimiter appear before the normal frame fields during transmission. They help the receiver synchronize and identify where the destination MAC address begins.

Ethernet Frame Fields in Transmission Order

The standard field order is:

1. Preamble
2. Start Frame Delimiter (SFD)
3. Destination MAC address
4. Source MAC address
5. Type/Length
6. Data and Pad
7. Frame Check Sequence (FCS)

An untagged standard Ethernet frame has a 14-byte header: 6 bytes for the destination MAC address, 6 bytes for the source MAC address, and 2 bytes for Type/Length. It also has a 4-byte trailer, the FCS.

Preamble and Start Frame Delimiter

The preamble is a 7-byte synchronization pattern transmitted before the main frame fields. It gives the receiving interface a predictable signal pattern that helps it synchronize its clock with the incoming transmission.

The 1-byte Start Frame Delimiter (SFD) follows the preamble. It indicates that the destination MAC address comes next. In other words, the SFD marks the boundary between synchronization information and the beginning of the Ethernet frame fields.

Although the preamble and SFD are transmitted with the frame, conventional Ethernet frame-size calculations usually exclude them. The commonly quoted 64-byte minimum and 1518-byte maximum are measured from the destination MAC address through the FCS.

Destination and Source MAC Addresses

A MAC address is a 48-bit, or 6-byte, Layer 2 address associated with an Ethernet interface. It is commonly written as six hexadecimal pairs, such as 00:1A:2B:3C:4D:5E.

The Destination MAC address identifies the local Ethernet recipient or recipients. The destination can be:

• Unicast: one specific interface, such as a host or router interface.
• Broadcast: every device on the local broadcast domain. The Ethernet broadcast address is FF:FF:FF:FF:FF:FF.
• Multicast: a selected group of interfaces that have joined a multicast group.

The Source MAC address identifies the Ethernet interface transmitting the frame. It normally contains one interface's unicast MAC address, not a broadcast or multicast address.

MAC addresses are used for delivery on the current local link. When a router forwards an IP packet to another network, it removes the incoming Ethernet frame and creates a new frame for the next link. The new frame has new source and destination MAC addresses. The Layer 3 IP packet provides the broader routed context, while the MAC addresses apply to each individual link.

The Type/Length Field

The 2-byte Type/Length field has two important interpretations. The interpretation depends on the Ethernet framing format.

Ethernet II and EtherType

In the widely used Ethernet II format, this field is an EtherType. It identifies the protocol carried in the Data and Pad field. Common values include:

For example, a value of 0x0800 tells the receiving Ethernet interface and operating system that the payload should be passed to IPv4 processing. A value of 0x86DD indicates IPv6.

IEEE 802.3 Length-Based Framing

In IEEE 802.3 length-based framing, the same 2-byte position represents the length of the payload rather than an EtherType. An LLC header, and sometimes an LLC/SNAP header, is then used to identify the upper-layer protocol.

These are different interpretations of the field:

• Ethernet II: the value identifies the encapsulated protocol directly through EtherType.
• IEEE 802.3: the value gives the payload length, with LLC or LLC/SNAP providing protocol identification.

Do not assume that every two-byte value in this position is an EtherType. In practice, values at or above the EtherType range are commonly interpreted as protocol identifiers, while smaller values can indicate IEEE 802.3 payload length.

Data and Pad

The Data portion carries the encapsulated upper-layer payload. In an Ethernet II example, that payload might be an IPv4 packet, an IPv6 packet, or an ARP message.

For an untagged standard Ethernet frame, the Data and Pad field is normally between 46 and 1500 bytes. The upper limit is associated with the standard Ethernet payload size. The lower limit exists because Ethernet has a minimum frame size.

If the meaningful payload is shorter than 46 bytes, Ethernet adds padding until the Data and Pad field reaches 46 bytes. Padding is not meaningful application data. It is extra space inserted to satisfy the Ethernet frame-size rule.

Padding Example

Suppose an Ethernet frame carries a 20-byte payload:

1. Required minimum Data and Pad size: 46 bytes.
2. Meaningful payload: 20 bytes.
3. Padding required: 46 - 20 = 26 bytes.

The resulting frame contains 20 bytes of actual payload and 26 bytes of padding in the Data and Pad field. Adding the other fields gives a 64-byte frame measured from Destination MAC through FCS:

Destination MAC  6 bytes
Source MAC       6 bytes
Type/Length      2 bytes
Data and Pad    46 bytes
FCS              4 bytes
                 --------
                 64 bytes

Frame Check Sequence and Error Detection

The Frame Check Sequence (FCS) is a 4-byte, or 32-bit, trailer field. The sender calculates a Cyclic Redundancy Check (CRC) over the relevant Ethernet frame contents and places the result in the FCS.

The receiver performs its own CRC calculation after receiving the frame. If the calculated result matches the received FCS, the frame passes this particular integrity check. If the results do not match, the frame was probably changed by corruption during transmission.

Ethernet uses the FCS for error detection, not error correction. Ethernet itself normally discards a frame with an invalid FCS; it does not repair the damaged bits. If the information must be recovered, a higher-layer mechanism may retransmit it. For example, TCP can retransmit missing data, while an application using UDP may need to provide its own recovery behavior.

Ethernet Frame Size Rules

The standard minimum frame size is 64 bytes, measured from the Destination MAC address through the FCS. The maximum standard untagged frame size is 1518 bytes, measured using the same boundaries.

The maximum is calculated as 14 + 1500 + 4 = 1518 bytes. The preamble and SFD are not included in that conventional number.

A runt frame is smaller than the permitted minimum Ethernet frame size. A runt may be associated with an error condition or abnormal device behavior. It should be investigated in the context of the interface, switch, duplex settings, cabling, and other link statistics.

An IEEE 802.1Q VLAN tag adds 4 bytes to the frame. Therefore, the commonly quoted maximum becomes 1522 bytes for a standard tagged frame. Other technologies and device configurations may support larger frames, such as jumbo frames, but those are extensions rather than the ordinary 1518-byte untagged limit.

IPv4 and IPv6 Encapsulation Examples

IPv4 Frame

Imagine a host sending an IPv4 packet to a device on the same LAN. The Ethernet frame could contain:

Destination MAC:  00:25:96:12:34:56
Source MAC:       08:00:27:AA:BB:CC
EtherType:        0x0800
Data:             IPv4 packet
FCS:              CRC calculated by the sender

The destination MAC identifies the local receiving interface. The source MAC identifies the sending interface. The EtherType 0x0800 identifies the Data field as an IPv4 packet. The sender appends an FCS after the payload and any required padding.

IPv6 Frame

An Ethernet II frame carrying IPv6 has the same field structure, but its EtherType is 0x86DD:

Destination MAC:  33:33:00:00:00:16
Source MAC:       08:00:27:AA:BB:CC
EtherType:        0x86DD
Data:             IPv6 packet
FCS:              CRC calculated by the sender

The field layout does not change merely because the payload protocol changes. The EtherType tells the receiver whether the payload is IPv4, IPv6, or another protocol.

Encapsulation Across Networking Layers

A simplified end-to-end view looks like this:

Application message
    inside a transport segment
        inside an IP packet
            inside an Ethernet frame
                Ethernet header + IP packet + FCS

The application creates data. A transport protocol such as TCP or UDP adds its header, producing a segment or datagram. IP adds its header, producing an IP packet. Ethernet then adds its local header, places the IP packet in the Data field, adds padding if needed, and appends the FCS.

At the receiving interface, Ethernet checks the frame and removes the Ethernet encapsulation. The resulting IP packet is passed to the network-layer processing code, which can then pass the transport data and application data upward.

What Changes at a Router?

Suppose an IP packet travels from one LAN to another through a router:

1. The sending host places the IP packet in an Ethernet frame for the first local link.
2. The router receives and decapsulates that frame.
3. The router forwards the IP packet through a different interface.
4. The router creates a new Ethernet frame for the next Ethernet link.
5. The new frame has a new source and destination MAC address pair and a newly calculated FCS.

The Layer 2 addresses therefore change at each routed Ethernet hop. The IP addresses are the relevant Layer 3 addresses for the routed packet, although fields such as the IPv4 TTL can change as the packet is forwarded.

Troubleshooting Frame Problems

CRC or FCS Errors

If an interface or switch reports CRC or FCS errors, received frames are failing the CRC validation. Possible causes include physical-layer noise, damaged cabling, poor connectors, or faulty network interfaces.

The FCS identifies that corruption occurred, but it does not identify the exact physical cause. Troubleshooting normally involves examining error counters, checking cables and connectors, testing the interface, and comparing behavior across ports or links.

Runt Frames

Runt frames are smaller than the valid minimum. This relates directly to the minimum 46-byte Data and Pad field and the 64-byte minimum measured frame size. The actual cause depends on the environment and may require investigation of physical conditions or device behavior.

Unexpected Protocol Type

If a packet capture shows an unexpected value in the Type/Length position:

1. Inspect the two-byte field.
2. Determine whether the frame is Ethernet II EtherType-based framing.
3. If the value represents a payload length, inspect the LLC or LLC/SNAP header for protocol identification.
4. Avoid assuming that every value in this position identifies an EtherType.

Exam-Relevant Summary

• An Ethernet frame is a Layer 2 data unit used for local Ethernet delivery.
• Encapsulation places an IP packet or another higher-layer payload inside the Ethernet Data field.
• The preamble is 7 bytes and supports receiver synchronization.
• The SFD is 1 byte and marks the beginning of the destination MAC address.
• Each MAC address is 6 bytes, or 48 bits.
• The untagged Ethernet II header is 14 bytes, and the FCS trailer is 4 bytes.
• EtherType 0x0800 identifies IPv4; 0x86DD identifies IPv6; 0x0806 identifies ARP.
• The untagged standard Data and Pad field is normally 46 to 1500 bytes.
• The 64-byte minimum and 1518-byte maximum exclude the preamble and SFD.
• Padding makes a short payload large enough to meet the minimum frame size.
• The FCS contains a CRC used to detect corruption; Ethernet normally discards a frame that fails the check.
• A VLAN tag adds 4 bytes, making the usual tagged maximum 1522 bytes.
• Routers replace the Ethernet frame at each routed link, so MAC addresses are local to each hop.

For related study, review Ethernet frame structure and field interpretation alongside lessons on MAC addressing, switching, VLAN tagging, and packet captures.