Ethernet Frame Structure Explained

What does one chunk of data traveling down an Ethernet cable actually look like?

What is a frame?

A frame is the unit of data exchanged at the data link layer (OSI Layer 2). It wraps the IP packet handed down from the layers above so it can be delivered to the next device on the same local network. Switches and network cards forward frames based on the MAC address inside them, not the IP address.

Preamble and SFD

The 7-byte preamble is an alternating 1-0 pattern that lets the receiving device sync its timing to the incoming signal, followed by a 1-byte Start Frame Delimiter (SFD) that marks where the real frame content begins. These 8 bytes are usually excluded when frame size is calculated.

Destination and source MAC address fields

Each 6 bytes long, these fields identify which two devices on the local network are exchanging the frame — destination first, then source. A switch reads this information to decide which port to forward the frame out of.

EtherType field

This 2-byte field acts as a label for what kind of payload the frame is carrying — for example 0x0800 for IPv4, 0x86DD for IPv6, and 0x0806 for ARP — telling the receiving device how to interpret the data that follows.

Payload (data)

The actual higher-layer packet being delivered, ranging from a minimum of 46 bytes to a maximum of 1500 bytes. Smaller payloads are padded out to the minimum; anything larger gets split across multiple frames by the layer above.

FCS (Frame Check Sequence)

A 4-byte error-detection value appended to the end of the frame, calculated with a CRC algorithm. The receiver recalculates it and silently discards the frame if the values don't match — FCS detects corruption, it doesn't repair it.

Minimum and maximum frame size

A standard Ethernet frame runs from 64 bytes minimum to 1518 bytes maximum (excluding the preamble), growing to 1522 bytes with an 802.1Q VLAN tag. Frames below 64 bytes are hard to distinguish from collision fragments, which is why the floor exists; 'jumbo frames' well above the max are a non-standard extension that only works between devices that both support them.

Frame vs. packet vs. segment

The same data is called a segment at the transport layer (TCP), a packet once IP addressing is added at the network layer, and a frame once MAC addressing is added at the data link layer for actual transmission. Each layer adding its own header on the way down is called encapsulation.

How the destination MAC address gets found

The IP-to-MAC lookup process that determines which MAC address goes into a frame is handled by ARP (Address Resolution Protocol) on IPv4 networks — worth understanding as the mechanism that fills in that field before a frame can be sent.

Where frames become electrical signals

Once assembled, a frame's bits are converted into electrical signals across the physical cabling — twisted-pair Ethernet cabling follows its own wiring standards (T568A/T568B) that determine how those signals map onto individual wire pairs.

Frequently Asked Questions

Does Wi-Fi use the same Ethernet frame format?

No — Wi-Fi (802.11) uses its own frame format with a different field layout, though similar in spirit. Traffic is generally converted to standard Ethernet framing once it crosses from the wireless link into a wired switch or router.

Is a jumbo frame always better?

Not necessarily. Frames larger than the standard 1500-byte payload reduce header overhead and can improve throughput for bulk transfers, but every device along the path — switches, network cards — needs to support the same jumbo frame size, or frames get fragmented or dropped.