Ethernet Frame - Explained!

Ethernet Frame

The Ethernet frame structure is defined in the IEEE 802.3 standard. Following explains a typical Ethernet Frame and description of each field in the frame:

• Preamble – informs the receiving system that a frame is starting and enables synchronization. The Preamble consists of seven bytes all of the form 10101010, and is used by the receiver to allow it to establish bit synchronization (there is no clocking information on the Ether when nothing is being sent). This is a stream of bits used to allow the transmitter and receiver to synchronize their communication. The preamble is an alternating pattern of binary 56 ones and zeroes. The preamble is immediately followed by the Start Frame Delimiter. An alternating 1,0 pattern provides a 5 MHz clock at the start of each packet, which allows the receiving devices to lock the incoming bit stream.

• SFD (Start Frame Delimiter) – signifies that the Destination MAC Address field begins with the next byte. The Start frame delimiter is a single byte, 10101011, which is a frame flag, indicating the start of a frame. This is always 10101011 and is used to indicate the beginning of the frame information. The preamble is seven octets and the SFD is one octet (synch). The SFD is 10101011, where the last pair of 1s allows the receiver to come into the alternating 1,0 pattern somewhere in the middle and still sync up to detect the beginning of the data.

• Destination MAC – identifies the receiving system. This is the MAC address of the machine receiving data. This transmits a 48-bit value using the least significant bit (LSB) first. The DA is used by receiving stations to determine whether an incoming packet is addressed to a particular node. The destination address can be an individual address or a broadcast or multicast MAC address. Remember that a broadcast is all 1s—all Fs in hex—and is sent to all devices. A multicast is sent only to a similar subset of nodes on a network.

• Source MAC – identifies the sending system. This is the MAC address of the machine transmitting data. The SA (Source Address) is a 48-bit MAC address used to identify the transmitting device, and it uses the least significant bit first. Broadcast and multicast address formats are illegal within the SA field.

• Type – defines the type of routed protocol inside the frame, for example IPv4 or IPv6. 802.3 uses a Length field, but the Ethernet_II frame uses a Type field to identify the Network layer protocol. The old, original 802.3 cannot identify the upper-layer protocol and must be used with a proprietary LAN—IPX, for example. The Type field for IPv4 is 08-00, mostly just referred to as 0x800 in hexadecimal, and 0x86dd for IPv6.

• Data and Pad – (aka Payload) contains the payload data. Padding data is added to meet the minimum length requirement for this field (46 bytes). This is the length of the entire Ethernet frame in bytes. It is rarely larger than 1500bytes as that is usually the maximum transmission frame size (MTU) for most serial connections. Ethernet networks tend to use serial devices to access the Internet. The data is inserted here. This is a packet sent down to the Data Link layer from the Network layer. The size can vary from 46 to 1,500 bytes.

• FCS (Frame Check Sequence) – contains a 32-bit Cyclic Redundancy Check (CRC) which allows detection of corrupted data. This field contains the Frame Check Sequence (FCS) which is calculated using a Cyclic Redundancy Check(CRC). The FCS allows Ethernet to detect errors in the Ethernet frame and reject the frame if it appears damaged.FCS is a field at the end of the frame that’s used to store the cyclic redundancy check (CRC) answer. The CRC is a mathematical algorithm that’s run when each frame is built based on the data in the frame. When a receiving host receives the frame and runs the CRC, the answer should be the same. If not, the frame is discarded, assuming errors have occurred.