Ethernet frame
In computer networking, an Ethernet frame is a data link layer protocol data unit and uses the underlying Ethernet physical layer transport mechanisms. In other words, a data unit on an Ethernet link transports an Ethernet frame as its payload.[2]
An Ethernet
Structure
A data packet on the wire and the frame as its payload consist of binary data. Ethernet transmits data with the most-significant octet (byte) first; within each octet, however, the least-significant bit is transmitted first.[a]
The internal structure of an Ethernet frame is specified in IEEE 802.3.[2] The table below shows the complete Ethernet packet and the frame inside, as transmitted, for the payload size up to the MTU of 1500 octets.[b] Some implementations of Gigabit Ethernet and other higher-speed variants of Ethernet support larger frames, known as jumbo frames.
Layer | Preamble | Start frame delimiter (SFD) | MAC destination | MAC source | 802.1Q tag (optional) |
Ethernet II) or length (IEEE 802.3 ) |
Payload | Frame check sequence (32‑bit CRC) | Interpacket gap (IPG) |
---|---|---|---|---|---|---|---|---|---|
Length (octets) | 7 | 1 | 6 | 6 | (4) | 2 | 42–1500[c] | 4 | 12 |
Layer 2 Ethernet frame | (not part of the frame) | ← 64–1522 octets → | (not part of the frame) | ||||||
Layer 1 Ethernet packet & IPG | ← 72–1530 octets → | ← 12 octets → |
The optional 802.1Q tag consumes additional space in the frame. Field sizes for this option are shown in brackets in the table above. IEEE 802.1ad (Q-in-Q) allows for multiple tags in each frame. This option is not illustrated here.
Ethernet packet – physical layer
Preamble and start frame delimiter
An Ethernet packet starts with a seven-octet (56-bit)
Representation | 56-bit (7-byte) Preamble | SFD byte | ||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
uncoded on-the-wire bit pattern transmitted from left to right (used by Ethernet variants transmitting serial bits instead of larger symbols)[1] : sections 4.2.5 and 3.2.2
|
10101010 | 10101010 | 10101010 | 10101010 | 10101010 | 10101010 | 10101010 | 10101011 | ||||||||
decimal in Ethernet LSb-first ordering[1] : sections 3.2.2, 3.3 and 4.2.6
|
85 | 85 | 85 | 85 | 85 | 85 | 85 | 213 | ||||||||
hexadecimal LSb-first bytes for 8-bit wide busses
( GMII bus for Gigabit Ethernet transceivers)
|
0x55 | 0x55 | 0x55 | 0x55 | 0x55 | 0x55 | 0x55 | 0xD5 | ||||||||
hexadecimal LSb-first RGMII for gigabit transceivers)
|
0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0x5 | 0xD |
The SFD is immediately followed by the destination MAC address, which is the first field in an Ethernet frame.
Frame – data link layer
Header
The header features destination and source MAC addresses (each six octets in length), the EtherType field and, optionally, an IEEE 802.1Q tag or IEEE 802.1ad tag.
The EtherType field is two octets long and it can be used for two different purposes. Values of 1500 and below mean that it is used to indicate the size of the payload in octets, while values of 1536 and above indicate that it is used as an EtherType, to indicate which protocol is encapsulated in the payload of the frame. When used as EtherType, the length of the frame is determined by the location of the interpacket gap and valid frame check sequence (FCS).
The
Payload
Payload is a variable-length field. Its minimum size is governed by a requirement for a minimum frame transmission of 64 octets (bytes).[e] With header and FCS taken into account, the minimum payload is 42 octets when an 802.1Q tag is present[f] and 46 octets when absent. When the actual payload is less than the minimum, padding octets are added accordingly. IEEE standards specify a maximum payload of 1500 octets. Non-standard jumbo frames allow for larger payloads on networks built to support them.
Frame check sequence
The frame check sequence (FCS) is a four-octet cyclic redundancy check (CRC) that allows detection of corrupted data within the entire frame as received on the receiver side. According to the standard, the FCS value is computed as a function of the protected MAC frame fields: source and destination address, length/type field, MAC client data and padding (that is, all fields except the FCS).
Per the standard, this computation is done using the left shifting CRC-32 (polynomial = 0x4C11DB7, initial CRC = 0xFFFFFFFF, CRC is post complemented, verify value = 0x38FB2284) algorithm. The standard states that data is transmitted least significant bit (bit 0) first, while the FCS is transmitted most significant bit (bit 31) first.[1]: section 3.2.9 An alternative is to calculate a CRC using the right shifting CRC-32 (polynomial = 0xEDB88320, initial CRC = 0xFFFFFFFF, CRC is post complemented, verify value = 0x2144DF1C), which will result in a CRC that is a bit reversal of the FCS, and transmit both data and the CRC least significant bit first, resulting in identical transmissions.
The standard states that the receiver should calculate a new FCS as data is received and then compare the received FCS with the FCS the receiver has calculated. An alternative is to calculate a CRC on both the received data and the FCS, which will result in a fixed non-zero "verify" value. (The result is non-zero because the CRC is post complemented during CRC generation). Since the data is received least significant bit first, and to avoid having to buffer octets of data, the receiver typically uses the right shifting CRC-32. This makes the "verify" value (sometimes called "magic check") 0x2144DF1C.[5]
However, hardware implementation of a logically right shifting CRC may use a left shifting Linear Feedback Shift Register as the basis for calculating the CRC, reversing the bits and resulting in a verify value of 0x38FB2284. Since the complementing of the CRC may be performed post calculation and during transmission, what remains in the hardware register is a non-complemented result, so the residue for a right shifting implementation would be the complement of 0x2144DF1C = 0xDEBB20E3, and for a left shifting implementation, the complement of 0x38FB2284 = 0xC704DD7B.
End of frame – physical layer
The end of a frame is usually indicated by the end-of-data-stream symbol at the physical layer or by loss of the carrier signal; an example is
Interpacket gap – physical layer
Interpacket gap (IPG) is idle time between packets. After a packet has been sent, transmitters are required to transmit a minimum of 96 bits (12 octets) of idle line state before transmitting the next packet.
Types
Frame type | Ethertype or length | Payload start two bytes |
---|---|---|
Ethernet II | ≥ 1536 | Any |
Novell raw IEEE 802.3 | ≤ 1500 | 0xFFFF |
IEEE 802.2 LLC | ≤ 1500 | Other |
IEEE 802.2 SNAP | ≤ 1500 | 0xAAAA |
There are several types of Ethernet frames:
- Ethernet II frame, or Ethernet Version 2,[g] or DIX frame is the most common type in use today, as it is often used directly by the Internet Protocol.
- Novell raw IEEE 802.3 non-standard variation frame
- Logical Link Control(LLC) frame
- IEEE 802.2 Subnetwork Access Protocol (SNAP) frame
The different frame types have different formats and MTU values, but can coexist on the same physical medium. Differentiation between frame types is possible based on the table on the right.
In addition, all four Ethernet frame types may optionally contain an IEEE 802.1Q tag to identify what VLAN it belongs to and its priority (
The IEEE 802.1Q tag, if present, is placed between the Source Address and the EtherType or Length fields. The first two octets of the tag are the Tag Protocol Identifier (TPID) value of 0x8100. This is located in the same place as the EtherType/Length field in untagged frames, so an EtherType value of 0x8100 means the frame is tagged, and the true EtherType/Length is located after the Q-tag. The TPID is followed by two octets containing the Tag Control Information (TCI) (the IEEE 802.1p priority (quality of service) and VLAN id). The Q-tag is followed by the rest of the frame, using one of the types described above.
Ethernet II
Ethernet II framing (also known as DIX Ethernet, named after
As this industry-developed standard went through a formal
In order to allow some frames using Ethernet II framing and some using the original version of 802.3 framing to be used on the same Ethernet segment, EtherType values must be greater than or equal to 1536 (0x0600). That value was chosen because the maximum length of the payload field of an Ethernet 802.3 frame is 1500 octets (0x05DC). Thus if the field's value is greater than or equal to 1536, the frame must be an Ethernet II frame, with that field being a type field.[9] If it's less than or equal to 1500, it must be an IEEE 802.3 frame, with that field being a length field. Values between 1500 and 1536, exclusive, are undefined.[10] This convention allows software to determine whether a frame is an Ethernet II frame or an IEEE 802.3 frame, allowing the coexistence of both standards on the same physical medium.
Novell raw IEEE 802.3
Novell's "raw" 802.3 frame format was based on early IEEE 802.3 work. Novell used this as a starting point to create the first implementation of its own IPX Network Protocol over Ethernet. They did not use any LLC header but started the IPX packet directly after the length field. This does not conform to the IEEE 802.3 standard, but since IPX always has FF as the first two octets (while in IEEE 802.2 LLC that pattern is theoretically possible but extremely unlikely), in practice this usually coexists on the wire with other Ethernet implementations, with the notable exception of some early forms of DECnet which got confused by this.
IEEE 802.2 LLC
Some protocols, such as those designed for the OSI stack, operate directly on top of IEEE 802.2 LLC encapsulation, which provides both connection-oriented and connectionless network services.
IEEE 802.2 LLC encapsulation is not in widespread use on common networks currently, with the exception of large corporate
There exists an
IEEE 802.2 SNAP
By examining the 802.2 LLC header, it is possible to determine whether it is followed by a SNAP header. The LLC header includes two eight-bit address fields, called service access points (SAPs) in OSI terminology; when both source and destination SAP are set to the value 0xAA, the LLC header is followed by a SNAP header. The SNAP header allows EtherType values to be used with all IEEE 802 protocols, as well as supporting private protocol ID spaces.
In IEEE 802.3x-1997, the IEEE Ethernet standard was changed to explicitly allow the use of the 16-bit field after the MAC addresses to be used as a length field or a type field.
The AppleTalk v2 protocol suite on Ethernet ("EtherTalk") uses IEEE 802.2 LLC + SNAP encapsulation.
Maximum throughput
We may calculate the
We may calculate the protocol efficiency for Ethernet
Maximum efficiency is achieved with largest allowed payload size and is:
for untagged frames, since the packet size is maximum 1500 octet payload + 8 octet preamble + 14 octet header + 4 octet trailer + minimum interpacket gap corresponding to 12 octets = 1538 octets. The maximum efficiency is:
when 802.1Q VLAN tagging is used.
The
- ,
where the physical layer
The total time considers the round trip time along the channel, the processing time in the hosts and the time transmitting data and acknowledgements. The time spent transmitting data includes data and acknowledgements.
Runt frames
A runt frame is an Ethernet frame that is less than the IEEE 802.3's minimum length of 64 octets. Runt frames are most commonly caused by
Notes
- ^ The frame check sequence (FCS) uses a different bit ordering.[3]
- ^ The bit patterns in the preamble and start of frame delimiter are written as bit strings, with the first bit transmitted on the left (not as octet values, which in Ethernet are transmitted least significant bit(s) first). This notation matches the one used in the IEEE 802.3 standard.
- ^ Payload can be 42 octets if an 802.1Q tag is present. Minimum is 46 octets without.
- OSI layer 2, which is where packet sniffers collect their data. There are layer-2 sniffers that can capture and display the preamble and start frame delimiter, but they are expensive and mainly used to detect problems related to physical connectivity.
- ^ Minimum payload size is dictated by the 512-bit slot time used for collision detection in the Ethernet LAN architecture.
- ^ Both 42 and 46 octet minimums are valid when 802.1Q is present.[4]
- ^ A version 1 Ethernet frame was used for early Ethernet prototypes and featured 8-bit MAC addresses and was never commercially deployed.
- ^ Original Ethernet frames define their length with the framing that surrounds it, rather than with an explicit length count.
References
- ^ ISBN 978-1-5044-5090-4.
- ^ ISBN 978-1-5044-5090-4.
- ISBN 978-1-5044-5090-4.
Opcodes are transmitted high-order octet first. Within each octet, bits are transmitted least-significant bit first. [...] Each octet of the MAC frame, with the exception of the FCS, is transmitted least significant bit first.
- ISBN 978-0-7381-6708-4.
- ^ "Specification of CRC Routines V4.5.0 R4.1 Rev 3" (PDF). AUTOSAR. p. 24. Archived from the original (PDF) on 11 June 2020. Retrieved 30 January 2020.
- ISBN 9780596552824. Retrieved 30 June 2014.
- ISBN 978-1-5044-5090-4.
- ISBN 978-0-672-31741-5.
- ^ LAN MAN Standards Committee of the IEEE Computer Society (20 March 1997). IEEE Std 802.3x-1997 and IEEE Std 802.3y-1997. The Institute of Electrical and Electronics Engineers, Inc. pp. 28–31.
- ISBN 978-1-5044-5090-4.
- ) — a classic series of Usenet postings by Novell's Don Provan that have found their way into numerous FAQs and are widely considered the definitive answer to the Novell Frame Type usage.
- ^ A Standard for the Transmission of IP Datagrams over IEEE 802 Networks. Network Working Group of the IETF. February 1988. .
- ^ Computer Society, IEEE (2016). IEEE Std 802.11-2016: Part 11: Wireless LAN Medium Access Control IEEE (MAC) and Physical Layer (PHY) Specifications. New York, NY: IEEE. p. 249.
- ^ "Troubleshooting Ethernet". Cisco Systems. Retrieved 13 August 2016.
Further reading
-
Video which explains how to build an Ethernet Frame
-
Minimum Frame Length in Ethernet explained