Ethernet Frame Format Explained

An Ethernet frame is a piece of data, along with the information required to transport and deliver it. In networking reference models, such as the OSI 7-Layer model (Open Systems Interconnection, which divides network functions into seven layers) and TCP/IP (Transmission Control Protocol/Internet Protocol, the standard suite for Internet communication), it is defined at the Data Link layer (Layer 2, responsible for local data transfer).

An Ethernet frame contains three parts: a header (Preamble, SFD, Destination, Source, and Type), Encapsulated data (Data and Pad), and a trailer (FCS).

The header

The header contains five fields: Preamble, SFD, Destination, Source, and Type. Each field stores unique information needed by the devices that process the frame in the path and the destination device that assembles data from frames. The following section explains the information stored in each field.

The preamble field

The preamble field is 7 bytes long and consists of a repeated '10101010' pattern. These bytes help the receiving device identify the beginning of an Ethernet frame. When a device detects 7 consecutive bytes of this pattern, it assumes an Ethernet frame is coming and synchronizes to the incoming bit-stream.

The SFD field

The SFD (Start Frame Delimiter) field is 1 byte long and contains a pattern similar to the preamble, except that the last bit is 1. The SFD byte indicates that the following bytes contain the destination MAC address of the Ethernet frame. The following image illustrates both fields and their bytes.

Destination MAC address

This 6-byte field contains the destination device's MAC address, represented as a 12-digit hexadecimal number (e.g., 0000.0A12.1234). The destination MAC address allows the receiving device to determine whether an incoming frame is intended for it. If a frame is not intended for the receiving device, the device discards it.

Source MAC address

This 6-byte field contains the source device's MAC address and allows the receiver to identify the sender for replies. The following image shows both address fields of a frame.

Type field

This 2-byte field identifies the network layer protocol (e.g., IP). The Data Link layer of the source computer prepares, encapsulates, and transmits the Ethernet frame onto the media. The Data link layer of the destination computer receives the Ethernet frame from the media, processes it, and then hands it to the upper layer for further processing. If multiple protocols are running in the upper (network) layer of the destination computer, the data link layer will fail to hand the received frame to the upper layer, as it does not know which protocol to deliver it to. The type field solves this issue. It allows the sender's computer to insert information about the upper-layer protocol. Through this information, the data link layer of the destination computer can easily determine the upper-layer protocol to which it should hand over the received frame.

Modern LAN implementations mostly use the IP protocol in the network layer. There are two variants of the IP protocol: IPv4 and IPv6. If the type field has a value of IP or 0x800, the frame carries IPv4 data. If it has a value of IPv6 or 0x86dd, the frame carries IPv6 data. The following image shows the type field for both IP variants.

Data and Pad field

This field stores the encapsulated data of the upper layer. This field has a size limit of 46 bytes (minimum) to 1500 bytes (maximum). Due to this limit, the network (upper) layer can not pack more or less data into a single packet (the encapsulated data of the upper layer). If the data falls short of the minimum requirement, padding is added. If the data exceeds the maximum limit, the excess is carried over to the next packet.

FCS (Frame Check Sequence)

This field is 4 bytes long. It stores a 4-byte value used to check whether the received frame is intact. The sender device takes all fields of the frame except the FCS field, and runs them through an algorithm known as the CRC (Cyclic Redundancy Check). The CRC algorithm generates a 4-byte result, which is placed in this FCS field. When the destination device receives a frame, it picks the same fields and runs the same algorithm on them. If the result matches the value stored in the FCS field, the frame is considered good and is processed further. If both values differ, the frame is considered bad and dropped.

Conclusion

Understanding the structure and function of each part of an Ethernet frame is crucial for analyzing network traffic and troubleshooting communication issues. The Ethernet frame’s header, data, and trailer work together to ensure reliable data transfer between devices on a network. Learning these concepts is essential for a deeper study of networking technologies and protocols.