Interpret Ethernet frame format


  • A header, data and trailer make up an Ethernet frame.
  • A data unit on an Ethernet link transports an Ethernet frame as its payload.
  • An Ethernet frame is preceded by a preamble and start frame delimiter (SFD), which are both part of the Ethernet packet at the physical layer.
  • In the below image, focus on the IEEE 802.3 (Revised 1997) depiction of an Ethernet Frame

Ethernet Frame Diagram

Preamble-

  • 7 bytes
  • Alternating 1s and 0s to make it easy for devices to synchronize their clocks

Start Frame Delimiter (SFD)-

  • 1 byte
  • Provides byte level synchronization and marks a new incoming frame

Destination MAC address-

  • 6 bytes
  • Identifies the intended recipient of this frame

Source MAC address-

  • 6 bytes
  • Identifies the sender of this frame

Length-

  • 2 bytes
  • Values of 1500 and below mean that it is used to indicate the size of the payload in octets
  • Defines the length of the data field of the frame (either length or type is present, but not both)

Type-

  • 2 bytes
  • Values of 1536 and above indicate that it is used as an EtherType, to indicate which protocol is encapsulated in the payload of the frame.
  • Defines the type of protocol listed inside the frame (either length or type is present, but not both)
  • Tag (optionally applied)
  • 4 bytes with the first 2 bytes doubling as the Type field
  • IEEE 802.1Q or IEEE 802.1ad tags are applied to indicate VLAN membership
  • IEEE802.1p tag is applied to indicate priority

Data and Padding-

  • 42 bytes minimum when an 802.1Q tag is applied
  • 46 bytes minimum without an 802.1Q tag applied
  • 1500 bytes maximum
  • Padding bytes are added if actual payload is not equal to 1500 bytes
  • Jumbo frames can be implemented to increase the maximum payload size
  • Payload is all the data from higher layers, fragmented to fit the max payload size

Frame Check Sequence (FCS)-

  • 4 bytes
  • A cyclic redundancy check (CRC) that allows detection of corrupted data within the entire frame as received on the receiver side
  • The FCS value is computed as a function of the protected MAC frame fields: source and destination address, length/type field, MAC client data and padding (that is, all fields except the FCS)
  • Running the CRC algorithm over the received frame data including the CRC code will always result in a zero value for error-free received data, because the CRC is a remainder of the data divided by the polynomial.