LearnNetwork
← Hubs, bridges, switches

The Ethernet frame — anatomy of a Layer-2 packet

8 min

Every Ethernet frame on every cable, fiber, or Wi-Fi air-link in the world has the same basic shape. Get the field names and what each is for, and you'll be able to read packet captures without flinching.

The full layout

+-----------+------+------+------+-----------+-----------+------+
| Preamble  | DST  | SRC  | Type | Payload   | Padding   | FCS  |
| 7 + 1 SFD | MAC  | MAC  | / Ln |           | (if <46)  |      |
| 8 bytes   | 6 B  | 6 B  | 2 B  | 46-1500 B |           | 4 B  |
+-----------+------+------+------+-----------+-----------+------+

| Field | Bytes | Purpose | |---|---|---| | Preamble + SFD | 7 + 1 | Bit sync; SFD marks "frame starts here." The PHY chip strips these — they never appear in your packet capture. | | Destination MAC | 6 | Who the frame is for. Can be unicast, multicast, or broadcast FF:FF:FF:FF:FF:FF. | | Source MAC | 6 | Who the frame is from. | | EtherType / Length | 2 | If ≥ 0x0600: an EtherType (what's in the payload). If smaller: the length (legacy 802.3). | | Payload | 46–1500 | The upper-layer PDU (usually an IP packet). Min 46 bytes so the frame meets the 64-byte minimum. | | Padding | varies | Added if payload <46 bytes. | | FCS | 4 | CRC32 over everything except the preamble. Detects bit errors. Mismatches are silently discarded. |

EtherType — what's inside

The EtherType tells the receiver how to interpret the payload:

| EtherType | Protocol | |---|---| | 0x0800 | IPv4 | | 0x86DD | IPv6 | | 0x0806 | ARP | | 0x8100 | 802.1Q VLAN-tagged (the real EtherType follows the tag) | | 0x8847 | MPLS unicast | | 0x8848 | MPLS multicast | | 0x88CC | LLDP | | 0x8809 | Slow Protocols (LACP / OAM) |

When a switch sees 0x8100, it knows the frame is VLAN-tagged and reads the 4-byte tag to find which VLAN before continuing.

Frame size limits

| Limit | Bytes | Why | |---|---|---| | Minimum frame | 64 (incl. FCS) | Required so collisions on legacy hubs were detectable. Still enforced. | | Maximum frame (standard) | 1518 (incl. FCS, no VLAN tag) | The classic Ethernet MTU. | | VLAN-tagged max | 1522 | Adds 4 bytes for the 802.1Q tag. | | Jumbo | 9018 (with tag) | Optional, end-to-end agreement required. | | Baby giants | 1500+ but <jumbo | Tagged frames slightly over 1518 — switches must accept these or VLAN trunks break. |

Frames below 64 bytes are runts; above the max are giants. Both are typically dropped and counted in interface error stats — useful diagnostic.

Destination MAC types

| Type | Pattern | Behavior | |---|---|---| | Unicast | First octet bit 0 (LSB) = 0 | One specific NIC | | Multicast | First octet bit 0 = 1, not all-ones | Receivers that joined the group process it | | Broadcast | FF:FF:FF:FF:FF:FF | Every NIC on the segment processes it |

Examples of multicast MACs: 01:80:C2:00:00:00 (STP BPDUs), 01:00:5E:xx:xx:xx (IPv4 multicast), 33:33:xx:xx:xx:xx (IPv6 multicast).

What to remember

  • Six fields: DST, SRC, EtherType, Payload, (Padding), FCS. Preamble + SFD live below.
  • EtherType says what's inside — IP, ARP, VLAN tag, MPLS, etc.
  • Min frame 64 B, max 1518 B (1522 with tag, 9018 with jumbo).
  • FCS catches bit errors silently; failed frames disappear and are counted in stats.
  • The destination MAC's lowest bit of the first octet tells unicast vs multicast.