Ethernet Frames and MAC Addresses

Ethernet is the framing that turns a stream of bits on a wire into discrete, addressed units. It wraps a payload in a header carrying a destination and source MAC address, an EtherType that names what is inside, and a trailing checksum that lets the receiver throw away anything that arrived corrupted. On every wired LAN you will ever touch, this is the structure a packet rides inside for each hop of its journey.

A MAC address is 48 bits — six bytes, written as aa:bb:cc:11:22:33 — and it is meaningful only on the local segment. It is not routable, it never travels end to end the way an IP address does, and the layer-2 header gets stripped and rebuilt at every router. The whole point of Ethernet is to get a frame from one port to the next port on the same wire; everything above it is somebody else's problem.

The Ethernet Frame Layout

A frame on the wire starts with a 7-byte preamble and a 1-byte start-of-frame delimiter that let the receiver's clock lock onto the bit stream — these are not part of the frame the software sees. Then comes the structure that matters: a 6-byte destination MAC, a 6-byte source MAC, a 2-byte EtherType, the payload, and a 4-byte frame check sequence. The header before the payload is 14 bytes total, which is the overhead you subtract from any link when computing how much real data fits.

The payload ranges from 46 to 1500 bytes on standard Ethernet. The 1500-byte ceiling is the MTU covered in Topic 10; the 46-byte floor exists because a frame must be at least 64 bytes on the wire for collision detection to work on legacy half-duplex segments, so short payloads get padded. Destination first, then source, is the order on the wire — a switch reads the destination it needs before it has finished receiving the rest of the frame.

# the MAC of an interface and the frame fields tcpdump decodes
ip link show eth0
# link/ether dd:ee:ff:44:55:66 brd ff:ff:ff:ff:ff:ff
tcpdump -e -n -i eth0
# dd:ee:ff:44:55:66 > aa:bb:cc:11:22:33, ethertype IPv4 (0x0800), length 98

MAC Address Structure

The first 24 bits of a MAC are the Organizationally Unique Identifier (OUI), assigned by the IEEE to a vendor; the last 24 bits are assigned by that vendor to the device. That split is what makes a factory-burned MAC globally unique — Apple, Intel, and Cisco each own OUI ranges, and tools that show vendor names are just looking the OUI up in a table. The address burned into the NIC is the default, not a law.

Two bits in the first byte carry meaning beyond identity. The least-significant bit of the first byte is the I/G bit: 0 means unicast, 1 means the frame is multicast or broadcast. The next bit is the U/L bit, which flips to 1 when an address is locally administered rather than vendor-burned. The all-ones address ff:ff:ff:ff:ff:ff is the broadcast address — every host on the segment must receive and process it.

The Frame Check Sequence

The 4-byte frame check sequence is a CRC-32 computed over the header and payload. The sender computes it and appends it; every receiver recomputes it and compares. If the values disagree, the frame is corrupt and gets silently dropped — there is no negative acknowledgment, no request to resend, nothing sent back to the source. Ethernet detects corruption and discards; it never repairs.

That distinction is the whole design philosophy of the link layer. Error correction would mean carrying redundant bits to reconstruct the original, which costs bandwidth on every frame to fix the rare bad one. Ethernet instead pushes recovery up the stack: a dropped frame becomes a missing TCP segment, and TCP retransmits it. The link layer's job is to make sure you never accept garbage, not to make sure nothing is ever lost.

EtherType and What the Frame Carries

The 2-byte EtherType field tells the receiver how to interpret the payload, so the right protocol handler gets it. 0x0800 is IPv4, 0x86DD is IPv6, 0x0806 is ARP, and 0x8100 signals an 802.1Q VLAN tag follows. Without this field the receiver would have a blob of bytes and no idea whether to hand it to the IP stack, the ARP handler, or somewhere else.

Values of 1500 or below in that field instead mean the older 802.3 length encoding rather than a type, a historical wrinkle that almost no current traffic uses. In practice you read the EtherType to answer one question fast in a capture: is this an IP packet, an ARP exchange, or a tagged VLAN frame? It is the demultiplexing key for the entire layer above.