Walk me through the fields of an Ethernet frame.
Show the answer
Say this first
On the wire: preamble (7 bytes) and SFD (1), then destination MAC (6), source MAC (6), an optional 802.1Q tag (4), EtherType or length (2), payload (46 to 1500) and FCS (4, a CRC-32). The frame counted from destination MAC to FCS is 64 to 1518 bytes, or up to 1522 with one VLAN tag.
Go deeper
Field by field
| Field | Bytes | Notes |
|---|---|---|
| Preamble | 7 | Alternating 1s and 0s for clock sync |
| SFD | 1 | 10101011, marks the start of the frame |
| Destination MAC | 6 | First so a switch can start the lookup early |
| Source MAC | 6 | What the switch learns from |
| 802.1Q tag | 4 | Optional. TPID 0x8100 plus PCP, DEI, VLAN ID |
| EtherType / length | 2 | 0x0600 (1536) and up is an EtherType; 1500 and below is an 802.3 length |
| Payload | 46 to 1500 | Padded up to 46 if shorter |
| FCS | 4 | CRC-32 over the frame; bad FCS means drop |
After every frame there is a 12-byte interframe gap. So a 64-byte frame really occupies 84 bytes of wire time, which is why 1 Gbps line rate is 1,488,095 frames per second at minimum size.
EtherTypes worth knowing
0x0800 IPv4, 0x86DD IPv6, 0x0806 ARP, 0x8100 802.1Q, 0x88A8 802.1ad outer tag,
0x8847 MPLS, 0x88CC LLDP, 0x8809 slow protocols (LACP).
Address bits
The lowest bit of the first byte is the I/G bit: 1 means group (multicast or broadcast). The next bit
is U/L: 1 means locally administered. ffff.ffff.ffff is broadcast; IPv4 multicast maps to
0100.5exx.xxxx and IPv6 multicast to 3333.xxxx.xxxx.
They will ask next
Why is the minimum frame 64 bytes?
Half-duplex CSMA/CD. A sender must still be transmitting when a collision from the far end of a maximum-size 10 Mbps network gets back to it, so the slot time is 512 bit times, which is 64 bytes. Full duplex has no collisions, but the minimum stayed for compatibility.
What are runts and giants?
A runt is shorter than 64 bytes, usually a collision fragment or a faulty NIC. A giant is larger than the port accepts (1518, or 1522 tagged, unless jumbo frames are enabled). Both are dropped and counted in
show interfaces.
Traps
- Counting the preamble in the 64-byte minimum. The minimum runs from destination MAC to FCS.
- Forgetting that a 4-byte tag pushes a full-size frame to 1522 bytes.