The ethernet frame format is the fixed layout of an ethernet frame: a destination MAC address, a source MAC address, a type or length field, the payload, and a frame check sequence, in that order.
The two MAC addresses are six octets each. The type field is two octets and does double duty: 1500 or below is a length, 1536 or above is an EtherType naming the protocol inside.
The payload is 46 to 1500 octets, padded up if the data is shorter, and the FCS is a four-octet CRC that catches corruption. A preamble and start frame delimiter come first but are not part of the frame, which runs 64 to 1518 octets, or 1522 with a VLAN tag.
- A frame is destination MAC, source MAC, type or length, payload, then FCS
- The two MAC addresses are six octets each; the type or length field is two
- Payload is 46 to 1500 octets, padded up to the 64-octet minimum frame
- The FCS is a four-octet CRC-32 that detects in-transit corruption
- The preamble and start frame delimiter come first but are not part of the frame
On this page
The layoutWhat the ethernet frame format is
The frame is the unit ethernet puts on the wire, and the ethernet frame format has barely changed since the standard was written. Once you know the order and the size of each field, you can read any frame in a capture.
Bytes and octets are the same thing here. The IEEE 802.3 standard counts in octets, eight bits each. Most networking courses and capture tools say bytes. This page uses both.
It is a fixed sequence of fields. Every ethernet frame carries the same fields in the same order: the destination MAC address first, then the source MAC address, then a two-octet type or length field, then the payload, and finally the frame check sequence.
A switch reads the start of the frame and knows exactly where each field begins because the sizes are fixed.
The header is 14 bytes and the trailer is 4. The two MAC addresses and the type field form the ethernet header, the 14 bytes every network card and switch reads. MAC stands for media access control, the sublayer that builds frames. The FCS is the trailer. Everything between them is data from the network layer.
The destination comes before the source. The destination MAC leads so a switch can start forwarding the moment it has read the first six octets, without waiting for the rest of the frame. Both addresses are six octets, the standard MAC address length.
The frame is a layer 2 structure. The MAC addresses, type field, payload and FCS together are the layer 2 frame. What the payload carries, an IP packet in almost every case, is a separate layer that the frame itself does not inspect.
This is the boundary the ethernet frame format draws: it moves data between two points on the same link, and leaves everything above it to the protocol named in the type field.
Type vs lengthThe type or length field
The two octets after the addresses are the one genuinely clever part of the format.
One field, two jobs. A value of 1500 or below is read as a length, the size of the payload in octets, which is the original IEEE 802.3 meaning.
A value of 1536, hex 0x0600, or above is read as an EtherType, a code naming the protocol inside, which is the Ethernet II meaning. The gap between 1500 and 1536 keeps the two interpretations from ever colliding.
EtherType is what you see today. Almost all modern traffic uses the Ethernet II framing, where this field is an EtherType: 0x0800 for IPv4, 0x86DD for IPv6, 0x0806 for ARP. The value tells the receiving stack which protocol handler to pass the payload to.
1536 was chosen on purpose. The threshold sits just above the maximum payload of 1500, so a length can never be mistaken for a type. It is why the same field has served both framings on the same wire for decades.
Payload and sizesThe payload, padding and frame sizes
The sizes are where the format's oldest constraint still shows.
The payload is 46 to 1500 bytes. The upper limit, 1500, is the ethernet MTU. The lower limit exists because the whole frame must be at least 64 bytes; with six-byte addresses, a two-byte type and a four-byte FCS, that leaves 46 bytes as the smallest payload.
Short payloads are padded. When the data is smaller than 46 bytes, the sender adds padding to reach the minimum. The receiver relies on the length or the higher-layer protocol to know how much of the payload is real data and how much is padding.
The 64-byte floor comes from the original collision-detection timing on shared ethernet, where a frame had to stay on the wire long enough for a collision to be detected, and it survives in the standard even though modern switched links no longer collide.
The whole frame is 64 to 1518 bytes. That is the frame from destination MAC through FCS. A frame below 64 bytes is a runt and is discarded. With an optional 802.1Q VLAN tag, which adds four bytes, the maximum rises to 1522. Jumbo frames are a non-standard extension beyond this.
The FCSThe frame check sequence
The last four bytes are the frame's integrity check.
It is a 32-bit CRC. The frame check sequence is a cyclic redundancy check computed over the frame's fields. The sender writes it; every receiver recomputes it and compares. This is how a switch or network card knows a transmission error corrupted the frame in transit.
A failed check means the frame is dropped. Ethernet does not repair a corrupt frame or ask for a resend. It discards the frame silently and leaves recovery to a higher layer such as TCP. A rising FCS error count on an interface is a classic sign of a bad cable or port.
Preamble and gapPreamble, SFD and the interpacket gap
Three things bracket the frame on the wire without being part of it.
The preamble synchronizes the receiver. Seven octets of alternating ones and zeros let the receiver lock its clock to the sender's bit timing before the real data arrives. It is a physical-layer construct, not part of the frame.
The SFD marks the start. The one-octet start frame delimiter ends in two consecutive ones instead of the alternating pattern, signaling that the next octet is the first of the destination MAC. Preamble plus SFD is eight octets ahead of every frame.
The interpacket gap follows. After a frame, ethernet leaves a twelve-octet idle gap before the next one, giving devices time to recover. Like the preamble, it is counted at the physical layer, not inside the frame.
On the wire, a full frame costs 1538 bytes. That is 1518 bytes of frame, 8 bytes of preamble and SFD, and the 12-byte gap. Frames are transmitted back to back at that spacing, so the data rate a saturated ethernet network delivers is always a little below the line rate.
Two framingsEthernet II and IEEE 802.3 framing
There are two framings behind the one layout, and the difference is small but worth knowing.
Ethernet II is the common one. In Ethernet II framing the two-octet field is an EtherType, and this is what virtually all IP traffic uses today. When people say the ethernet frame format without qualifying it, this is the frame they mean: destination MAC, source MAC, EtherType, payload, FCS.
802.3 uses the same field as a length. The original IEEE 802.3 framing treats that field as a length and relies on a separate header, the LLC and sometimes SNAP header, at the start of the payload to name the protocol. It is rare on modern networks outside a few protocols such as spanning tree.
One wire carries both. Because the length values and the EtherType values never overlap, a receiver can tell which framing a given frame uses from that field alone. That is the whole reason the 1536 threshold exists, and it is why both framings have coexisted on ethernet for decades.
The four frame types in a capture
Older networks and some protocol analyzers distinguish four ethernet frame types. All four share the same addresses and FCS. They differ only in what follows the source MAC.
- Ethernet II frame. A two-byte EtherType, then the data. Also called DIX, after Digital, Intel and Xerox, the companies that published it.
- Novell raw 802.3 frame. A length field followed directly by an IPX packet with no LLC header. Novell NetWare networks used it, and it carries nothing but IPX.
- IEEE 802.3 frame with 802.2 LLC. A length field, then a three-byte LLC header holding the destination and source service access points and a control byte.
- IEEE 802.3 frame with SNAP. The LLC header followed by a five-byte SNAP header, a three-byte organization code and a two-byte protocol ID, which lets an 802.3 frame carry EtherType values.
On a current network almost every frame is Ethernet II. Spanning tree BPDUs use LLC, and Cisco protocols such as CDP use SNAP, so the other types still appear in a capture.
PitfallsWhere people go wrong
A handful of mistakes come up again and again when people first read a frame.
Counting the preamble as part of the frame. The preamble and SFD are eight bytes on the wire, but they are physical-layer overhead. The frame, and every size the standard quotes, starts at the destination MAC.
Treating the type field as always a type. On most traffic it is an EtherType, but a value of 1500 or below is a length. Reading a length as a type, or the reverse, misparses the rest of the frame.
Forgetting the minimum, and the padding. A tiny payload does not make a tiny frame. It is padded to keep the frame at 64 bytes, so a 10-byte message still rides in a 64-byte frame.
Assuming the FCS fixes errors. It only detects them. A frame that fails the check is dropped, and it is up to a higher layer to notice the loss and resend.
Ignoring the VLAN tag when sizing. A tagged frame is four bytes larger, up to 1522. A link or device that has not been told to expect tagged frames may treat those extra bytes as an oversized frame and drop it.
ComparisonThe five frame fields at a glance
| Criterion | Destination MAC | Source MAC | Type / length | Payload | FCS |
|---|---|---|---|---|---|
| Size in octets | 6 | 6 | 2 | 46 to 1500 | 4 |
| Part of the frame | Yes | Yes | Yes | Yes | Yes |
| What it holds | Where it is going | Where it came from | Protocol or size | The data | A CRC-32 |
| Read first by | A switch, to forward | The source stack | The receiving stack | The receiving stack | Every receiver |
| If wrong | Sent to the wrong port | Learning is polluted | Wrong handler | Corrupt data | Frame dropped |
The type or length field and the FCS are the two that repay a second look; the rest are addresses and data in a fixed order.
FAQFrequently asked questions
What is the ethernet frame format?
The fixed layout of an ethernet frame: a six-octet destination MAC address, a six-octet source MAC address, a two-octet type or length field, a payload of 46 to 1500 octets, and a four-octet frame check sequence, in that order.
What are the fields of an ethernet frame?
Destination MAC, source MAC, type or length, payload, and frame check sequence. A preamble and start frame delimiter precede the frame on the wire but are not counted as part of it, and an optional 802.1Q tag can sit between the source MAC and the type field.
How big is an ethernet frame?
From 64 to 1518 octets, measured from the destination MAC through the frame check sequence. With an 802.1Q VLAN tag it can reach 1522 octets. Anything below 64 octets is a runt and is discarded.
What is the minimum ethernet frame size?
64 octets. That floor forces a minimum payload of 46 octets, and shorter data is padded up to reach it. The minimum comes from the original collision-detection timing of shared ethernet.
What is the difference between EtherType and length?
They share one two-octet field. A value of 1500 or below is a length giving the payload size, the IEEE 802.3 meaning. A value of 1536 or above is an EtherType naming the protocol inside, the Ethernet II meaning. The gap between them prevents confusion.
What is the frame check sequence?
A four-octet, 32-bit cyclic redundancy check computed over the frame. The receiver recomputes it and, if it does not match, discards the frame. Ethernet does not repair or retransmit; that is left to a higher layer.
Is the preamble part of the ethernet frame?
No. The seven-octet preamble and one-octet start frame delimiter are physical-layer constructs that help the receiver synchronize. They belong to the physical layer and come before the frame, not counted in its 64-to-1518-octet size.
What is an EtherType value?
A code in the type field naming the protocol carried in the payload. Common values are 0x0800 for IPv4, 0x86DD for IPv6, and 0x0806 for ARP. It tells the receiving stack which protocol handler should process the payload.
What is the difference between Ethernet II and 802.3 framing?
They use the same field after the MAC addresses differently. Ethernet II treats it as an EtherType; the original IEEE 802.3 treats it as a length. Almost all modern traffic uses Ethernet II framing.
What is a runt frame?
An ethernet frame shorter than the 64-octet minimum. Runts are usually caused by collisions or a faulty interface and are discarded. A rising runt count on a port points to a physical problem.
Where does the 802.1Q VLAN tag go?
Between the source MAC address and the type or length field. The tag is four octets and carries the VLAN ID and a priority value, which is why a tagged frame's maximum size rises from 1518 to 1522 octets.
Why is the destination MAC address first?
So a switch can begin forwarding as soon as it has read the first six octets, before the rest of the frame has arrived. Putting the destination ahead of the source is what makes cut-through switching possible.
What is in the Ethernet header?
The Ethernet header is 14 bytes: a 6 byte destination MAC address, a 6 byte source MAC address, and a 2 byte EtherType that names the protocol inside. A VLAN tag adds 4 bytes. The rest of the Ethernet frame structure is the payload and a 4 byte frame check sequence at the end.
Keep readingRelated concepts
Read next · Switching What Is a VLAN? The 802.1Q tag that slots into the frame and raises its maximum size. Open this next14 min- Diagnostics · 12 min MTU and Fragmentation, and the Numbers Worth Memorizing Why the payload tops out at 1500 octets and what happens above it.
- Switching · 9 min The MAC Address Table, and How to Find Which Port a Device Is On How a switch uses the source and destination MAC in every frame.
- Network fundamentals · 9 min Wake on LAN, and How the Magic Packet Powers a Machine On The magic packet that wakes a machine rides inside one such frame.