Ethernet frame

In computer networking, an Ethernet frame is a data link layer protocol data unit and uses the underlying Ethernet physical layer transport mechanisms. In other words, a data unit on an Ethernet link transports an Ethernet frame as its payload.
An Ethernet frame is preceded by a preamble and start frame delimiter, which are both part of the Ethernet packet at the physical layer. Each Ethernet frame starts with an Ethernet header, which contains destination and source MAC addresses as its first two fields. The middle section of the frame is payload data, including any headers for other protocols carried in the frame. The frame ends with a frame check sequence, which is a 32-bit cyclic redundancy check used to detect any in-transit corruption of data.

Structure

A data packet on the wire and the frame as its payload consist of binary data. Ethernet transmits data with the most-significant octet first; within each octet, however, the least-significant bit is transmitted first.
The internal structure of an Ethernet frame is specified in IEEE 802.3. The table below shows the complete Ethernet packet and the frame inside, as transmitted, for the payload size up to the MTU of 1500 octets. Some implementations of Gigabit Ethernet and other higher-speed variants of Ethernet support larger frames, known as jumbo frames.
The optional 802.1Q tag consumes additional space in the frame. Field sizes for this option are shown in brackets in the table above. IEEE 802.1ad allows for multiple tags in each frame. This option is not illustrated here.

Ethernet packet – physical layer

Preamble and start frame delimiter

An Ethernet packet starts with a seven-octet preamble and one-octet start frame delimiter. The preamble bit values alternate 1 and 0, allowing receivers to synchronize their clock at the bit-level with the transmitter. The preamble is followed by the SFD, which ends with a 1 instead of 0, to break the bit pattern of the preamble and signal the start of the actual frame.
Physical layer transceiver circuitry is required to connect the Ethernet MAC to the physical medium. The connection between a PHY and MAC is independent of the physical medium and uses a bus from the media-independent interface family. The preamble and SFD representation depend on the width of the bus:
The SFD is immediately followed by the destination MAC address, which is the first field in an Ethernet frame.

Frame – data link layer

Header

The header features destination and source MAC addresses, the EtherType field, and, optionally, an IEEE 802.1Q tag or IEEE 802.1ad tag.
The EtherType field is two octets long and it can be used for two different purposes. Values of 1500 and below mean that it is used to indicate the size of the payload in octets, while values of 1536 and above indicate that it is used as an EtherType, to indicate which protocol is encapsulated in the payload of the frame. When used as EtherType, the length of the frame is determined by the location of the interpacket gap and valid frame check sequence.
The IEEE 802.1Q tag or IEEE 802.1ad tag, if present, is a four-octet field that indicates virtual LAN membership and IEEE 802.1p priority. The first two octets of the tag are called the Tag Protocol IDentifier and double as the EtherType field indicating that the frame is either 802.1Q or 802.1ad tagged. 802.1Q uses a TPID of 0x8100. 802.1ad uses a TPID of 0x88a8.

Payload

Payload is a variable-length field. Its minimum size is governed by a requirement for a minimum frame transmission of 64 octets. With header and FCS taken into account, the minimum payload is 42 octets when an 802.1Q tag is present and 46 octets when absent. When the actual payload is less than the minimum, padding octets are added accordingly. IEEE standards specify a maximum payload of 1500 octets. Non-standard jumbo frames allow for larger payloads on networks built to support them.

Frame check sequence

The frame check sequence is a four-octet cyclic redundancy check that allows detection of corrupted data within the entire frame as received on the receiver side. According to the standard, the FCS value is computed as a function of the protected MAC frame fields: source and destination address, length/type field, payload data and padding.
Per the standard, this computation is done using the left shifting CRC-32 algorithm. The standard states that data is transmitted least significant bit first, while the FCS is transmitted most significant bit first. An alternative is to calculate a CRC using the right shifting CRC-32, which will result in a CRC that is a bit reversal of the FCS, and transmit both data and the CRC least significant bit first, resulting in identical transmissions.
The standard states that the receiver should calculate a new FCS as data is received and then compare the received FCS with the FCS the receiver has calculated. An alternative is to calculate a CRC on both the received data and the FCS, which will result in a fixed non-zero verify value.. Since the data is received least significant bit first, and to avoid having to buffer octets of data, the receiver typically uses the right shifting CRC-32. This makes the verify value 0x2144DF1C.
However, hardware implementation of a logically right shifting CRC may use a left shifting Linear Feedback Shift Register as the basis for calculating the CRC, reversing the bits and resulting in a verify value of 0x38FB2284. Since the complementing of the CRC may be performed post calculation and during transmission, what remains in the hardware register is a non-complemented result, so the residue for a right shifting implementation would be the complement of 0x2144DF1C = 0xDEBB20E3, and for a left shifting implementation, the complement of 0x38FB2284 = 0xC704DD7B.

End of frame – physical layer

The end of a frame is usually indicated by the end-of-data-stream symbol at the physical layer or by loss of the carrier signal; an example is 10BASE-T, where the receiving station detects the end of a transmitted frame by loss of the carrier. Later physical layers use an explicit end of data or end of stream symbol or sequence to avoid ambiguity, especially where the carrier is continually sent between frames; an example is Gigabit Ethernet with its 8b/10b encoding scheme that uses special symbols which are transmitted before and after a frame is transmitted.

Interpacket gap – physical layer

is idle time between packets. After a packet has been sent, transmitters are required to transmit a minimum of 96 bits of idle line state before transmitting the next packet.

Types

There are several types of Ethernet frames:

Ethernet II frame, or Ethernet Version 2, or DIX frame is the most common type in use today, as it is often used directly by the Internet Protocol.
Novell raw IEEE 802.3 non-standard variation frame
IEEE 802.2 Logical Link Control frame
IEEE 802.2 Subnetwork Access Protocol frame

The different frame types have different formats and MTU values, but can coexist on the same physical medium. Differentiation between frame types is possible based on the table on the right.
In addition, all four Ethernet frame types may optionally contain an IEEE 802.1Q tag to identify what VLAN it belongs to and its priority. This encapsulation is defined in the IEEE 802.3ac specification and increases the maximum frame size by 4 octets.
The IEEE 802.1Q tag, if present, is placed between the Source Address and the EtherType or Length fields. The first two octets of the tag are the Tag Protocol Identifier value of 0x8100. This is located in the same place as the EtherType/Length field in untagged frames, so an EtherType value of 0x8100 means the frame is tagged, and the true EtherType/Length is located after the Q-tag. The TPID is followed by two octets containing the Tag Control Information . The Q-tag is followed by the rest of the frame, using one of the types described above.

Ethernet II

Ethernet II framing, defines the two-octet EtherType field in an Ethernet frame, preceded by destination and source MAC addresses, that identifies an upper layer protocol encapsulated by the frame data. Most notably, an EtherType value of 0x0800 indicates that the frame contains an IPv4 datagram, 0x0806 indicates an ARP datagram, and 0x86DD indicates an IPv6 datagram. See for more.
Image:Ethernet Type II Frame format.svg|thumb|center|700px|The most common Ethernet frame format, type II
As this industry-developed standard went through a formal IEEE standardization process, the EtherType field was changed to a length field in the new 802.3 standard. Since the recipient still needs to know how to interpret the frame, the standard required an IEEE 802.2 header to follow the length and specify the type. Many years later, the 802.3x-1997 standard, and later versions of the 802.3 standard, formally approved of both types of framing. Ethernet II framing is the most common in Ethernet local area networks, due to its simplicity and lower overhead.
In order to allow some frames using Ethernet II framing and some using the original version of 802.3 framing to be used on the same Ethernet segment, EtherType values must be greater than or equal to 1536. That value was chosen because the maximum length of the payload field of an Ethernet 802.3 frame is 1500 octets. Thus if the field's value is greater than or equal to 1536, the frame must be an Ethernet II frame, with that field being a type field. If it's less than or equal to 1500, it must be an IEEE 802.3 frame, with that field being a length field. Values between 1500 and 1536, exclusive, are undefined. This convention allows software to determine whether a frame is an Ethernet II frame or an IEEE 802.3 frame, allowing the coexistence of both standards on the same physical medium.