Ethernet Frame Structure
A frame used in Ethernet (Ethernet II / IEEE 802.3) is made up of several fields. This article explains the role of each field and the frame size.
Description of Each Field
| Field Name | Size | Description |
|---|---|---|
| Preamble | 7 bytes | A bit pattern that repeats 10101010 seven times. Used to synchronize the receiver’s clock with the sender’s. |
| SFD (Start Frame Delimiter) | 1 byte | A fixed pattern of 10101011. Indicates that the frame body (destination MAC address) begins immediately after. |
| Destination MAC Address | 6 bytes | The MAC address of the device the frame is being sent to. Broadcast (FF:FF:FF:FF:FF:FF) and multicast addresses can also be specified. |
| Source MAC Address | 6 bytes | The MAC address of the device that sent the frame. |
| Type/Length (EtherType) | 2 bytes | If the value is 1500 (0x05DC) or less, it represents the data length; if it is 1536 (0x0600) or more, it represents the upper-layer protocol type (EtherType). |
| Data (Payload) | 46–1500 bytes | The data body passed from the upper layer. If it is less than 46 bytes, padding is added to satisfy the minimum frame length. |
| FCS (Frame Check Sequence / CRC) | 4 bytes | A CRC32 checksum calculated over the fields from the destination MAC address through the data. Used to detect bit errors during transmission. |
Destination MAC Address
The destination MAC address field holds either a unicast address (addressed to one specific device), a multicast address, or the broadcast address (FF:FF:FF:FF:FF:FF). The first bit of the address (the first bit transmitted on the wire — in hexadecimal notation this is the least significant bit of the first octet, so the first octet is odd, as in 01:xx:xx:xx:xx:xx) indicates whether it is unicast (0) or multicast (1) — the I/G bit — and an address of all 1s is the broadcast address. A receiving interface discards the frame if the destination address doesn’t match its own address, a registered multicast address, or the broadcast address.
Source MAC Address
The source MAC address field holds the unicast address of the interface that sent the frame. The Ethernet MAC layer itself doesn’t interpret this value, but it’s used by upper-layer protocols, troubleshooting, and by switches to build the source-address tables they use to learn which port leads to which address. For an address assigned by the IEEE to a manufacturer (a globally administered address), the upper 24 bits are the vendor identifier known as the OUI (Organizationally Unique Identifier), while the lower 24 bits are specific to each interface. Looking up the OUI lets you infer which vendor’s equipment an address belongs to (MAC OUI Vendor Lookup Tool).
Locally Administered Address
An address whose second bit (the U/L bit — in hexadecimal notation the second-least-significant bit of the first octet, so addresses starting with 02:xx:xx:xx:xx:xx, or more generally x2/x6/xA/xE) is 1 is a locally administered address, set freely by the device itself and unrelated to any IEEE assignment. MAC addresses assigned to virtual machines, and the randomized Wi-Fi MAC addresses that devices generate to protect privacy, both fall into this category — and their vendor cannot be identified from the OUI.
As the figure shows, a 48-bit MAC address is split into the OUI (first 3 octets) and the NIC-specific part (last 3 octets); the least significant bit of the first octet (b0) is the I/G bit and the bit next to it (b1) is the U/L bit. In hexadecimal notation, if the second hex digit of the first octet is 2, 6, A or E, the U/L bit is 1 (locally administered); if it is odd, the I/G bit is 1 (multicast).
Common EtherType Values
When the value of the Type/Length field is 1536 (0x0600) or greater, that value indicates the upper-layer protocol type (EtherType). Common values are as follows.
| EtherType Value | Protocol |
|---|---|
0x0800 | IPv4 |
0x0806 | ARP |
0x8100 | IEEE 802.1Q VLAN-tagged frame |
0x86DD | IPv6 |
0x8847 | MPLS unicast |
0x8848 | MPLS multicast |
0x8863 | PPPoE Discovery Stage |
0x8864 | PPPoE Session Stage |
0x888E | IEEE 802.1X EAPOL |
0x88CC | LLDP |
EtherType values are managed by the IEEE Registration Authority, and the full list of assigned values is published here.
Frame Size
| Range | Size | Notes |
|---|---|---|
| MAC frame (destination MAC address through FCS) | 64–1518 bytes | The frame size as defined by the Ethernet standard. |
| Total transmitted data (including preamble and SFD) | 72–1526 bytes | The size of the full bit stream actually sent over the cable. |
If the data is less than 46 bytes, padding is inserted to satisfy the minimum frame length of 64 bytes (MAC frame). This minimum size is required for collision detection to function correctly under CSMA/CD.
Also, when an 802.1Q VLAN tag is added, a 4-byte VLAN tag is inserted between the source MAC address and the Type/Length field, extending the maximum frame length to 1522 bytes.