Ethernet Frames and MAC Addresses
- An Ethernet II frame is a 14-byte header (destination MAC, source MAC, EtherType), a payload of 46 to 1500 bytes, and a 4-byte FCS. That is 64 to 1518 bytes, or 1522 with an 802.1Q tag.
- A MAC address is 48 bits naming one network interface on one link. It is rewritten at every hop, so it never crosses the internet.
- Two bits in the first byte carry meaning: bit 0 says unicast or multicast (broadcast is all ones), bit 1 says vendor-assigned or locally administered (randomised, virtual).
- On the wire each frame also costs an 8-byte preamble and a 12-byte gap, so the smallest frame occupies 84 bytes of line time and a 10 GbE port tops out at 14.88 million frames per second.
- The MTU is the payload limit (1500), not the frame size (1518). Every device on a link must agree on it, which is why jumbo frames are a per-domain decision.
Mental model
A frame is an envelope with a street-number sticker for the next mailbox only. The sticker says "deliver to the box three doors down", not "deliver to Alice in another city". At that box the envelope is opened, a new envelope is made for the next leg, and a new sticker goes on. The letter inside (the IP packet) is untouched the whole way.
Where it breaks: the sticker names a network card, not a person. Move the card to another computer and the sticker follows the card. Some cards even change their own sticker on request, which a mailbox number never does.
A frame header is the stack frame and return address for one function call. It exists for exactly one hop, the callee reads it, discards it, and builds a fresh one to call the next function. The payload is the argument passed through unchanged. The FCS is the checksum the callee verifies before trusting the arguments.
Where it breaks: a return address is something the program chose. A frame's source MAC is a value the sender can set to anything, and nothing on a plain LAN checks it, so it is a claim and not proof of identity.
How it works
A host hands the link layer a packet and a next-hop IP. ARP (see ARP) turns that next-hop IP into a MAC, and the NIC wraps the packet in a frame. Which IP is the next hop (the destination itself, or the default gateway) is decided by the rules in how a host decides where to send a packet. Every protocol header side by side, including this one as a 32-bit-wide bit diagram, is in header diagrams. This page draws the frame the other way, as a bar, because here the byte counts and the time on the wire are the point.
The frame, to scale
The preamble is seven bytes of 0xAA (10101010) so the receiver's clock can lock on, then the start frame delimiter 0xAB marks where the real frame begins. The receiver strips both, so software never sees them. The interframe gap is 96 bit times of silence, which is 12 bytes, between one frame and the next.
| Field | Size | Purpose | Notes |
|---|---|---|---|
| Preamble + SFD | 7 + 1 B | Clock sync, then start-of-frame marker | Added and removed by the NIC hardware. Not counted in the frame size, and never in a capture. |
| Destination MAC | 6 B | The interface that should accept this frame | Unicast, multicast or broadcast (see the MAC section below). |
| Source MAC | 6 B | The interface that sent it | How a switch learns where a host is. Always unicast. |
| EtherType | 2 B | What protocol the payload is | 0x0800 IPv4, 0x0806 ARP, 0x86DD IPv6, 0x8100 802.1Q tag. Values from 1536 up are types. |
| 802.1Q tag | 4 B, optional | VLAN id and priority | Sits between source MAC and EtherType, see VLANs. |
| Payload | 46 to 1500 B | The network-layer packet, for example IPv4 | Shorter data is padded with zeros up to 46. |
| FCS | 4 B | CRC-32 over the frame | Mismatch means the frame is dropped silently. The math is on error detection. |
| Interframe gap | 12 B of idle | Lets receivers recover between frames | Not part of any frame, but it costs line time. |
Deriving the size limits
All three come from adding up the fields in the table.
- Header and trailer: 6 + 6 + 2 + 4 (FCS) = 18 bytes of overhead around the payload.
- Maximum frame: 1500 + 18 = 1518 bytes. With an 802.1Q tag, 1500 + 18 + 4 = 1522.
- Minimum frame: the standard fixes it at 64 bytes, so the minimum payload is 64 - 18 = 46 bytes. With a tag the minimum frame is still 64, so the minimum payload is 42.
- Line time: add the 8-byte preamble and SFD and the 12-byte gap to every frame. Minimum 8 + 64 + 12 = 84. Maximum 8 + 1518 + 12 = 1538.
Wire efficiency and line rate
Efficiency is payload bytes divided by line-time bytes.
| Case | Payload | Line time | Efficiency |
|---|---|---|---|
| Smallest frame | 46 B | 84 B | 46 / 84 = 54.8% |
| Full frame, MTU 1500 | 1500 B | 1538 B | 1500 / 1538 = 97.5% |
| Full frame carrying TCP over IPv4, no options | 1460 B of TCP data | 1538 B | 1460 / 1538 = 94.9% |
| Jumbo frame, MTU 9000 | 9000 B | 9000 + 38 = 9038 B | 9000 / 9038 = 99.6% |
The 38 in the last row is 18 of header and trailer plus 8 of preamble plus 12 of gap. The 1460 is the 1500 payload minus 20 bytes of IPv4 header and 20 of TCP header, the MSS covered on MTU, MSS and fragmentation.
The other number worth deriving is the maximum frame rate. A 10 Gbit/s link moves 10 x 109 bits per second and the smallest frame occupies 84 x 8 = 672 bits, so:
10 x 109 / 672 = 14,880,952 frames per second, about 14.88 million.
That is one frame every 672 bits / 10 Gbit/s = 67.2 ns. A CPU core has about that long to receive, parse and route each frame, which is the reason software routers and load balancers that need line rate with small packets use kernel-bypass stacks such as DPDK. The same arithmetic gives 1.49 Mpps at 1 GbE and 148.8 Mpps at 100 GbE.
A real frame, field by field
Host 10.0.0.5 (MAC aa:bb:cc:11:22:33, an illustrative address) wants to reach 10.0.0.9 and has no ARP entry, so its first frame is an ARP request.
| Field | Bytes (hex) | Meaning |
|---|---|---|
| Destination MAC | ff ff ff ff ff ff | Broadcast: every interface on the LAN accepts it |
| Source MAC | aa bb cc 11 22 33 | The sender |
| EtherType | 08 06 | 0x0806 means ARP |
| Payload | 28 B of ARP + 18 B of zero padding | The ARP request is 28 bytes, padded up to the 46-byte minimum |
| FCS | 4 B | Added by the NIC |
The frame is 14 + 46 + 4 = 64 bytes, the legal minimum. When 10.0.0.9 answers, its reply is a unicast frame to aa:bb:cc:11:22:33. The sender then builds its first real frame, say one ping: the destination MAC is 10.0.0.9's MAC, the EtherType is 08 00, and the payload is the 84-byte IPv4 packet (20 bytes IP header, 8 ICMP header, 56 data), so the frame is 14 + 84 + 4 = 102 bytes. Everything else about the IP packet is on the IP packet page.
Deep dive
MAC address structure
A MAC address is 48 bits written as six bytes in hex. It has two halves and two special bits, defined by IEEE 802 and 802.3.
- OUI (organizationally unique identifier): the first 24 bits, assigned to a manufacturer by the IEEE Registration Authority. The public lookup is the IEEE OUI registry. IEEE also sells longer blocks (28 and 36 bit prefixes) to smaller vendors, so the first three bytes alone do not always identify one company. The last 24 bits are numbered by the vendor, which gives 224 = 16,777,216 addresses per OUI.
- I/G bit (individual or group), bit 0 of the first byte, value
0x01. 0 means a unicast address, 1 means a group (multicast) address. Broadcastff:ff:ff:ff:ff:ffis the all-ones group address, so it has this bit set. - U/L bit (universal or local), bit 1 of the first byte, value
0x02. 0 means the address was assigned by the IEEE scheme (universally administered). 1 means someone assigned it locally: a hypervisor, a container runtime, or a phone's private Wi-Fi address.
Two quick decodes. 3c is 0011 1100, both low bits 0, a vendor unicast address. The en0 address on the macOS machine used for the Hands-on section starts with 6e, which is 0110 1110: I/G is 0 (unicast) and U/L is 1, a locally administered address. A single first-byte check, byte & 0x02, tells you whether an address can be looked up in the OUI registry at all.
Special MAC ranges
| Address or prefix | Meaning | Used by |
|---|---|---|
ff:ff:ff:ff:ff:ff | Broadcast: all interfaces on the LAN | ARP requests, DHCP discover (see ARP) |
01:00:5e + 0 + 23 bits | IPv4 multicast: the low 23 bits of the group address are copied in (RFC 1112, section 6.4) | mDNS 224.0.0.251 maps to 01:00:5e:00:00:fb |
33:33 + 32 bits | IPv6 multicast: the low 32 bits of the group address are copied in (RFC 2464, section 7) | IPv6 neighbor discovery, which replaces broadcast ARP |
01:80:c2:00:00:00 | Spanning tree bridge group address (IEEE 802.1D) | STP BPDUs, never forwarded by a bridge |
01:80:c2:00:00:0e | LLDP nearest-bridge address (IEEE 802.1AB) | Neighbor discovery between switches and phones |
The IPv4 multicast mapping is lossy by arithmetic: a group address has 28 variable bits and only 23 fit, so 25 = 32 different IPv4 groups share each MAC. Hosts filter again at the IP layer. IPv6 has no broadcast at all: what IPv4 does with an ARP broadcast, IPv6 does with a multicast to a small group per address, so only the right host's NIC wakes up.
EtherType versus length
Original Ethernet (the DIX specification, formalised for IP in RFC 894) used the two bytes after the source MAC as a type. The 802.3 standard reused the same two bytes as a length of the payload. The two never collide because of the numbers: 1500 is 0x05DC and the lowest EtherType is 1536, 0x0600. A value of 1500 or less is a length, 1536 or more is a type, and 1501 to 1535 is undefined. In practice everything on an IP network uses the type form. The registry of types is maintained by IANA and described in RFC 7042.
Why 64 bytes, and does it still matter
On a shared-medium Ethernet, a sender must still be transmitting when news of a collision comes back from the far end, or it will think the frame got through. The standard turns that into a rule: the round trip over the largest allowed network must fit in 512 bit times, the slot time. At 10 Mbit/s that is 512 / (10 x 106) = 51.2 microseconds, and 512 bits is 64 bytes, hence the minimum frame. The full collision-detection story is on switches and MAC learning. Full-duplex switched links never collide, so the rule no longer protects anything, but the 64-byte minimum stayed in the standard so every speed and every old and new device still interoperate.
The 802.1Q tag and the 1522 maximum
A VLAN tag is 4 bytes inserted before the EtherType, so the maximum frame grows from 1518 to 1522 while the payload limit stays at 1500. The fields and the trunk/access behaviour belong to VLANs. Because the bytes change, the switch recomputes the FCS when it adds or removes the tag.
MTU, jumbo frames and path agreement
The MTU is the largest payload the link will carry: 1500. The frame is 1518. Jumbo frames raise the payload to commonly 9000 bytes, which cuts per-frame CPU cost and header overhead (99.6% versus 97.5% efficiency in the table above). They help most for storage and HPC traffic that sends long streams between machines you control. They hurt when one device on the path still has MTU 1500 and path MTU discovery is broken, because large packets then vanish. There is no negotiation: every interface in the broadcast domain must be configured alike. The fragmentation and PMTUD consequences are on MTU, MSS and fragmentation.
MAC randomisation
A fixed MAC on a phone lets any access point it passes follow the owner. So phones now use a random MAC for Wi-Fi. Apple documents a Private Wi-Fi Address (iOS 14 and later) that is different for each network and, as of 2026-10, fixed on secured networks but rotating on open ones from iOS 18, and Android documents MAC randomization behavior from Android 10. Windows offers a random hardware address setting for Wi-Fi as well. All of these set the U/L bit to 1.
Consequences you meet in operations:
- DHCP reservations and MAC filters keyed on a device's hardware address stop matching, or match a different address per network.
- Captive portals and "known device" lists that remember a MAC treat a returning phone as new if the address changes.
- ARP and switch tables are unaffected: they just see another address.
- Network access control has to move to something stronger than a MAC, such as 802.1X certificates or accounts.
Ethernet speeds and media
| Standard | Year | Medium | Max reach | Typical use |
|---|---|---|---|---|
| 10BASE5 (802.3) | 1983 | Thick coax bus | 500 m per segment | Original shared bus |
| 10BASE-T (802.3i) | 1990 | Twisted pair, hub in the middle | 100 m | Office LANs of the 1990s |
| 100BASE-TX (802.3u) | 1995 | Cat 5 twisted pair | 100 m | Fast Ethernet desktops, IoT |
| 1000BASE-T (802.3ab) | 1999 | Cat 5e twisted pair | 100 m | Standard wired desktop port |
| 10GBASE-T (802.3an) | 2006 | Cat 6a twisted pair | 100 m | Servers, workstations |
| 10GBASE-SR (802.3ae) | 2002 | Multimode fiber | Up to 300 m on OM3 fiber | Data center racks |
| 25G to 400G (802.3by, ba, bs) | 2016, 2010, 2017 | Fiber and short copper | Depends on the optic | Data center leaf and spine |
Reach is a property of the cable and optic variant, so check the clause for the specific PHY before assuming it. The full list of projects and years is kept by the IEEE 802.3 working group.
Auto-negotiation
Twisted-pair ports exchange capability advertisements when a cable is plugged in and settle on the best speed and duplex they share. 1000BASE-T requires it. The usual way it goes wrong is one end hard-set to a fixed speed and duplex while the other still negotiates, which leaves a mismatch that the switch page covers under late collisions.
Textbook vs real world
| The textbook says | Production does | Why |
|---|---|---|
| A MAC address is burned in and globally unique | Phones randomise it, hypervisors and container runtimes assign locally administered ones, cloned VMs can duplicate one, and any OS can override it | The address is just a field the NIC driver fills in. Uniqueness only needs to hold inside one L2 domain. |
| Ethernet means CSMA/CD | Every modern link is full-duplex point-to-point, so nothing collides | Switches gave each port its own collision domain, and the collision rules survive only as the 64-byte minimum. |
| Minimum payload is 46 bytes, so you see padded frames | tcpdump on the sender often shows short frames, for example length 42 for an ARP request | Padding and FCS are added by the NIC after the capture point, and offload features can also merge or split frames before the wire. |
| MTU is 1500 | Often 9001 inside an AWS VPC, 1500 toward the internet, and 1450 or less on an overlay | Encapsulation spends payload bytes. VXLAN adds 14 + 20 + 8 + 8 = 50 bytes of outer headers, so a 1500 underlay leaves 1450. |
In production
- AWS lets instances use an MTU of 9001 for traffic inside a VPC, while traffic leaving through an internet gateway is limited to 1500 (AWS EC2 network MTU).
- Kubernetes CNIs set the pod interface MTU to the underlay MTU minus the overlay overhead. Calico documents the MTU to configure for each encapsulation mode it supports. VXLAN itself is specified in RFC 7348.
- Data centers run 25, 100 and 400 Gbit/s server and spine links over fiber and short copper cables, the speeds defined by the 802.3 clauses in the table above (IEEE 802.3).
- Asset and access tooling resolves the OUI of each MAC against the IEEE registry to label a device's vendor. A randomised address has the U/L bit set and will not resolve, which is the cue to treat it as "private address" and not as an unknown vendor.
History and evolution
- 1973 Bob Metcalfe's memo at Xerox PARC sketches a shared coaxial cable that many machines contend for. The experimental network ran at 2.94 Mbit/s (Metcalfe and Boggs, CACM 1976).
- 1980 The DIX consortium (DEC, Intel, Xerox) publishes the 10 Mbit/s Ethernet specification, with the type field.
- 1983 IEEE 802.3 standardises 10 Mbit/s CSMA/CD over thick coax and reuses the type bytes as a length.
- 1990 10BASE-T moves to twisted pair and a hub per room, because coax was expensive to pull and one break took the whole bus down. Hubs still shared one collision domain, which broke under load.
- 1995 Fast Ethernet (100 Mbit/s) arrives with auto-negotiation. Switches follow, removing collisions by giving each port its own domain.
- 1999 Gigabit Ethernet over Cat 5e makes full-duplex switched links the norm.
- 2002 10 GbE, then 100 GbE (2010) and 400 GbE (2017), as server and data center bandwidth demand outgrows each generation.
- Now Wired Ethernet is the near-universal LAN. The current speed projects are listed by the IEEE 802.3 working group.
- Next 800G and 1.6T for data center fabrics, single-pair Ethernet in cars and factories, and time-sensitive networking (TSN) for deterministic delivery.
Hands-on
Linux shows the MAC as link/ether:
brd ff:ff:ff:ff:ff:ff is the broadcast address from the table above. On macOS (real output from the machine used for this page, MAC redacted):
The first byte 6e has the U/L bit set (decoded earlier), consistent with a private Wi-Fi address. The neighbor table shows MACs too (real, redacted):
macOS prints each byte without a leading zero, so f0:9:d is f0:09:0d. The second entry's first byte 1a is 0001 1010, U/L set, a locally administered neighbor. To see the header of each frame, capture with -e (needs root, output below is illustrative):
Read the source and destination MACs, then the EtherType. Note length 42: that is 14 + 28, the frame before the NIC added its 18 bytes of padding and the 4-byte FCS. To check the Ethernet speed, duplex and auto-negotiation on Linux:
Finally, prove the MTU of 1500. An ICMP echo carries 8 bytes of ICMP header and the IP header is 20, so the largest data that fits is 1500 - 20 - 8 = 1472. On macOS, -D sets the don't-fragment bit (real output, run against the local router):
The first reply is 1480 bytes because it counts the 8-byte ICMP header (1472 + 8), and a 1500-byte packet crossed the link. One more data byte and the host refuses to send. On Linux the equivalent is ping -M do -s 1472 host.
Gotchas
Interview questions
Show answer
Destination MAC (6 bytes), source MAC (6), EtherType (2), payload (46 to 1500) and FCS (4). On the wire there is also a 7-byte preamble and a 1-byte start frame delimiter before the destination MAC, which the NIC strips. The header is 14 bytes and the frame is 64 to 1518 bytes.
Follow-ups:
- Which field never reaches software? The preamble, SFD and usually the FCS, all handled by the NIC.
- Why 6 bytes for a MAC? 48 bits give 248 addresses, enough that each manufacturer can number its cards without coordination beyond the 24-bit OUI.
Show answer
It is the I/G bit, the lowest bit of the first byte. 0 is unicast, one interface. 1 is a group address, which a NIC accepts only if it has subscribed to that group. Broadcast ff:ff:ff:ff:ff:ff is the all-ones group address that every interface accepts.
Follow-ups:
- What does IPv6 do instead of broadcast? It uses multicast, mapped to
33:33plus the low 32 bits of the group address, so only interested hosts wake up.
Show answer
On shared Ethernet a sender must still be transmitting when a collision signal returns from the farthest station. The standard's slot time is 512 bit times, which at 10 Mbit/s is 51.2 microseconds, and 512 bits is 64 bytes. Frames shorter than that could finish before a collision was detected.
Follow-ups:
- Does it matter on full duplex? No collisions occur, but the minimum stays for compatibility.
Show answer
The MTU is the largest payload a link carries, 1500 on standard Ethernet. The frame adds 18 bytes (14 header, 4 FCS), so 1518, or 1522 with a VLAN tag. Jumbo frames raise the MTU to around 9000 and need every interface on the segment configured the same.
Follow-ups:
- How do you test the path MTU? Ping with the don't-fragment bit and a data size of 1472 (1500 minus 20 IP minus 8 ICMP), and raise or lower it.
Show answer
Only on different L2 domains, since the address only has to be unique on its own link. On the same domain, a switch's table would map the address to two ports and flip between them, and traffic for either host would reach the wrong one at random. Cloned VMs and fake addresses are the usual causes.
Follow-ups:
- What does an operator see? Repeated "MAC flapping" or "MAC move" alerts on the switch, and intermittent connectivity.
Show answer
A fixed Wi-Fi MAC can be observed by any access point to track a person across places. Phones now use a private address, typically stable per network (SSID), with the U/L bit set. It breaks DHCP reservations, MAC allow lists, captive portals that remember devices, and any inventory keyed by MAC.
Follow-ups:
- How would you do access control then? Authenticate the user or device with 802.1X, certificates or accounts instead of trusting a MAC.
Show answer
Each minimum frame occupies 64 + 8 preamble and SFD + 12 gap = 84 bytes, which is 672 bits of line time. 10 x 109 / 672 is about 14.88 million frames per second, one every 67.2 ns.
Follow-ups:
- Why does this drive kernel-bypass stacks like DPDK? The kernel's per-packet cost of interrupts, copies and context switches exceeds 67 ns, so line rate on small packets needs polling and zero-copy.
Fun facts
- The broadcast MAC is all ones: 48 bits of 1, written
ff:ff:ff:ff:ff:ff. - The first three bytes of a (non-randomised) MAC reveal the vendor, which is how tools label the "Apple" or "Intel" next to a device.
- 1500 is
0x05DCand the lowest EtherType is 1536 (0x0600). The gap between them is what lets one field mean either length or type. - On macOS
arp -adrops leading zeros, so one byte0x09prints as9.
Cheat sheet
- 14 B - Ethernet header (6 + 6 + 2)
- 64 to 1518 B - frame size; 1522 B with an 802.1Q tag
- 46 to 1500 B - payload, with 1500 as the standard MTU
- 84 B - minimum line time per frame (8 preamble and SFD + 64 + 12 gap)
- 14.88 Mpps - 10 GbE line rate for minimum frames
- 97.5% - wire efficiency of a full 1500-byte payload (1500 / 1538)
- 0x01 and 0x02 - I/G and U/L bits in the first byte of a MAC