Ethernet Frames

An ethernet frame is a small envelope: six bytes of destination, six bytes of source, two bytes saying what’s inside, and a payload.

Frame Structure

3c:22:fb:66:6a:d0

3c:22:fb:e2:d0:2c

0x0800

db 3b 59 21 90 11 8a fd ab 85 fb 67 6b 04 86 fa fe 5a 71 15 f9 5b 82 b6 d1 d1 d1 ad ae 17 0a c2 4a 79 90 d6 61 5b c3 de eb 9c 50 2c 2a fb

Example Frame

ff:ff:ff:ff:ff:ff  b8:27:eb:12:34:56  0806  <payload…>
        ↑                  ↑            ↑
        │                  │            └─ EtherType: 0x0806 = ARP
        │                  └────────────── Source MAC (b8:27:eb = Raspberry Pi OUI)
        └───────────────────────────────── Destination MAC (broadcast)

Breaking it down:

• Destination MAC (6 bytes): ff:ff:ff:ff:ff:ff
  • All bits set is the broadcast address — every host on the LAN receives it
• Source MAC (6 bytes): b8:27:eb:12:34:56
  • First 3 bytes are the OUI (vendor), last 3 identify the NIC
• EtherType (2 bytes): 0806
  • Identifies the protocol inside the payload
• Payload (46–1500 bytes): the packet handed down from the layer above

MAC Address Bits

The two lowest bits of the first byte flag two properties:

The broadcast ff:ff:ff:ff:ff:ff is a multicast with every bit set.

Common EtherTypes

When the EtherType is 0x8100, a 4-byte VLAN tag sits between the source MAC and the real EtherType. Paste a VLAN-tagged frame into the explorer above and the extra field appears automatically.

Frame Sizes

A standard ethernet frame on the wire ranges from 64 bytes (14 header + 46 padded payload + 4 FCS) to 1518 bytes (14 + 1500 + 4). Jumbo frames go up to around 9018 bytes.

References

• IEEE 802.3: Ethernet Standard
• IANA EtherType Registrations
• Wikipedia: Ethernet frame