This tutorial explains the format, parts, and types of an Ethernet frame in detail. Learn what does an Ethernet frame contains and how to interpret the Ethernet format.
What is the Ethernet frame?
An Ethernet frame is a piece of data along with the information that is required to transport and deliver that piece of data. In networking reference models, such as; OSI Seven Layers model and TCP/IP, the Ethernet frame is defined in the Data link layer.
Ethernet format
An Ethernet frame contains three parts; an Ethernet header (Preamble, SFD, Destination, Source, and Type), Encapsulated data (Data and Pad), and an Ethernet trailer (FCS).
The following image shows an example of an Ethernet frame.
Ethernet header
Ethernet header contains five fields; Preamble, SFD, Destination, Source, and Type. Let's understand each field in detail.
The preamble field
The preamble field is 7 bytes long. It contains a string of 7 bytes. Each byte alternatively stores 1 and 0 to make the pattern '10101010'. Preamble bytes help the receiving device to identify the beginning of an Ethernet frame. When a device receives 7 continuous bytes of the same pattern (10101010), it assumes that the incoming data is an Ethernet frame and it locks the incoming bit-stream.
The SFD field
The SFD (Start Frame Delimiter) field is 1 byte long. It contains a string of 1 byte. This byte also stores the same pattern, except the last bit. In the last bit, it stores 1 instead of the 0. The following image shows both fields with their related bytes respectively.
The SFD byte indicates the receiving device that the next byte is the destination MAC address of the Ethernet frame.
Destination MAC address
This field is 6 bytes long. It contains the MAC address of the destination device. MAC address is 6 bytes or 48 bits (1 byte = 8 bits, 6x8 = 48bits) long. For convenience, usually, it is written as 12-digit hexadecimal numbers (such as 0000.0A12.1234).
The destination MAC address allows the receiving device to determine whether an incoming frame is intended for it or not. If a frame is not intended for the receiving device, the receiving device discards that frame.
Source MAC address
This field is also 6 bytes long. It contains the MAC address of the source device. It helps the receiving device in identifying the source device. The following image shows an example of both types of address in the frame.
Type field
This field is 2 bytes long. This field stores information about the protocol of the upper layer (network layer).
The Data Link layer of the source computer prepares, packs and loads the Ethernet frame in the media. The Data link layer of the destination computer picks the Ethernet frame from the media. After picking the Ethernet frame, the Data link layer of the destination computer unpacks, processes, and hands over that Ethernet frame to the upper layer for further processing.
If multiple protocols are running in the upper (network) layer of the destination computer, the data link layer will fail to hand over the received frame to the upper layer as it does not know to which protocol it should give the received frame.
To learn more about how layers exchange and process data, you can check this tutorial.
Data Encapsulation and De-encapsulation Explained
The type field solves this issue. This field allows the sender computer to insert the information of the upper layer protocol. Through this information, the data link layer of the destination computer can easily determine the upper layer protocol to which it should hand over the received frame.
Modern LAN implementations mostly use the IP protocol in the network layer. There are two variants of the IP protocol; IPv4 and IPv6. If the type field has value IP or ox800, the frame is carrying the data of the IPv4 protocol. If the type field has value IPv6 or 0x86dd, the frame is carrying the data of the IPv6 protocol.
The following image shows an example of the type field for both IP variants.
Data and Pad field
This field stores the encapsulated data of the upper layer. This field has a size limit of 46 bytes (minimum) to 1500 bytes (maximum). Due to this limit, the network (upper) layer can't pack more or less data in a single packet (encapsulated data of the upper layer). If data is less than the minimum requirement, padding is added. If data is more than the maximum limit, extra data is packed in the next packet.
FCS (Frame Check Sequence)
This field is 4 bytes long. This field stores a 4 bytes value that is used to check whether the received frame is intact or not. The sender device takes all fields of the frame except the FCS field, and runs them through an algorithm, known as the CRC (Cyclic Redundancy Check). The CRC algorithm generates a 4-byte result, which is placed in this FCS field.
When the destination device receives a frame, it takes the same fields and runs them through the same algorithm. If the result matches with the value stored in the FCS field, the frame is considered good and is processed further. If both values do not match, the frame is considered bad and is dropped.
That's all for this tutorial. If you like this tutorial, please don't forget to share it with friends through your favorite social platform.
