Ethernet Frame Structure

Detailed breakdown of the fields in an Ethernet frame (Preamble, MAC Addresses, FCS).

What is an Ethernet Frame?

In networking, data is not sent as a continuous, endless stream. Instead, it is broken down into manageable chunks. In the context of Ethernet networks (Layer 2 of the OSI model), this chunk of data is called a frame. You can think of an Ethernet frame as a digital envelope: it contains the data you want to send (the letter), but it's also wrapped with crucial addressing and control information (the address, stamp, and envelope material) to ensure it reaches its destination correctly within a local network.

This structured format is fundamental to how Ethernet works. Every device on an Ethernet network, from your computer to a network switch, understands this structure. This allows them to read the addresses, check for errors, and forward the data to the appropriate place. There are two dominant frame formats that are very similar and often used together: the original Ethernet II (also called DIX) and the slightly modified IEEE 802.3 standard.

Anatomy of an Ethernet II / IEEE 802.3 Frame

An Ethernet frame is composed of several distinct sections, or "fields". While some fields are technically part of the physical transmission and not the frame itself, understanding all of them is key. The total size of a standard frame on the wire can range from a minimum of 84 bytes to a maximum of 1538 bytes, including all parts.

Ethernet II frame explorer

Click a field to learn its role and review typical frame sizes.

Example payloads

28-byte ARP payload padded to meet the 64-byte minimum frame length.

0x001C (28 bytes + padding)

Destination MAC

6 bytes

Layer-2 address of the intended receiver. Can be unicast, multicast or broadcast.

Frames shorter than 64 bytes are considered runts; standard Ethernet II payload maximum is 1500 bytes (jumbo frames excluded).

Field	Size (Bytes)	Purpose
Preamble	7	Receiver clock synchronization.
Start Frame Delimiter (SFD)	1	Marks the end of the preamble and the start of the actual frame.
Destination MAC Address	6	Physical address of the recipient device.
Source MAC Address	6	Physical address of the sending device.
EtherType / Length	2	Identifies the upper-layer protocol (Ethernet II) or specifies the payload length (IEEE 802.3).
Data (Payload) and Pad	46 - 1500	Contains the actual data being sent (e.g., an IP packet). Padding is added if data is less than 46 bytes.
Frame Check Sequence (FCS)	4	Error-checking field to detect transmission errors.

Field by Field: A Deep Dive

Let's examine each part of the frame in detail.

1. Preamble & Start Frame Delimiter (SFD)

These first 8 bytes work together to prepare the receiving device for the incoming data. The Preamble is a 7-byte sequence of alternating ones and zeros (&grave;10101010...&grave;). This pattern creates a stable 10 MHz square wave on the wire, which allows the receiver's circuitry to lock onto the sender's clock signal and achieve bit-level synchronization.

The Start Frame Delimiter (SFD) is a 1-byte field with the pattern &grave;10101011&grave;. It immediately follows the Preamble. The final two '1' bits break the alternating pattern, signaling to the receiver: "Synchronization is complete, the actual frame starts with the very next bit!"

2. Destination & Source MAC Addresses

These two fields contain the physical hardware addresses, known as , of the destination and source devices. These addresses are essential for delivering frames within a local network segment. Both fields are 6 bytes (48 bits) long. The Source Address is always the unique address of the sending device. The Destination Address can be one of three types, determined by the first bit transmitted.

3. EtherType / Length Field

This 2-byte field is clever but can be confusing, as it serves two different purposes depending on its value. This is a result of the coexistence of the Ethernet II and IEEE 802.3 standards.

A receiving network interface card (NIC) looks at the decimal value of this field to decide how to interpret the frame:

If the value is 1536 or greater ( $\ge 0x0600$ ), the field is interpreted as an EtherType. This indicates an Ethernet II frame, and the value tells the receiving device which upper-layer protocol (e.g., IPv4, IPv6, ARP) is encapsulated in the data payload.
If the value is 1500 or less ( $\le 0x05DC$ ), the field is interpreted as the Length of the data payload that follows. This indicates an IEEE 802.3 frame.

4. Data (Payload) and Padding

This is the actual "letter in the envelope." It contains the data from the upper network layers, such as an IP packet. The size of this field can vary.

The maximum size of the payload is 1500 bytes, known as the . If an upper-layer packet is larger than this, it must be fragmented before being sent.

Ethernet also has a minimum frame size requirement of 64 bytes (from Destination MAC to FCS). Therefore, the data payload must be at least 46 bytes long. If the actual data is smaller than 46 bytes, the sender adds extra, meaningless bytes called Padding to bring the field up to the minimum required size.

5. Frame Check Sequence (FCS)

The final 4 bytes of the frame contain the Frame Check Sequence. This field is used for error detection. The sending device performs a mathematical calculation, a , over all the fields from the Destination MAC to the Pad field. The 32-bit result is placed in the FCS.

The receiving device performs the exact same calculation on the received frame. If its calculated result matches the value in the FCS field, the frame is considered error-free and is passed up to the next network layer. If the values do not match, it indicates that a bit was flipped during transmission, and the entire frame is silently discarded. Ethernet provides error detection, but not error correction; it relies on higher-level protocols (like TCP) to handle retransmission of lost data.