Every packet that travels across an Ethernet network is encapsulated inside a frame. Understanding the Ethernet frame structure is foundational for the CCNA 200-301 exam (Objective 1.3) and for real-world troubleshooting — when a frame is malformed, connectivity breaks, and you need to know exactly which field is wrong. This chapter dissects the frame byte by byte, from the preamble to the FCS, so you can decode any packet capture and ace exam questions on framing.
Jump to a section
Think of an Ethernet frame like a physical letter sent through the postal service. The letter itself is the data you want to send (the IP packet). But before you mail it, you place it inside an envelope. The envelope has specific fields: a return address (source MAC), a destination address (destination MAC), and sometimes a note about the type of contents (EtherType). The postal service also adds a postmark and a tracking barcode (preamble and start frame delimiter) to help sort and deliver the letter. At the bottom of the envelope, there might be a security seal (frame check sequence) to ensure the letter wasn't tampered with. If the envelope is too small or too large, the postal service may reject it — just like Ethernet has minimum and maximum frame sizes (64 to 1518 bytes). If the seal is broken, the recipient knows the contents are corrupted. Every step of mail delivery relies on the envelope being correctly formatted; similarly, every switch and NIC relies on the frame fields being in the right order and within size limits. This analogy maps directly to the Ethernet frame: the preamble is the postmark, the destination MAC is the recipient address, the source MAC is the return address, the EtherType tells the receiver what protocol is inside (like IPv4 or ARP), and the FCS is the tamper-evident seal. The payload (the letter) is the encapsulated packet. Without a proper envelope, the mail cannot be delivered — without a proper frame, the data cannot be passed up the protocol stack.
What Is an Ethernet Frame?
An Ethernet frame is the Layer 2 PDU (Protocol Data Unit) that carries data across an Ethernet network. It is the container that encapsulates the Layer 3 packet (usually an IP packet) and adds the addressing and error-checking information needed for delivery on a local network segment. The IEEE 802.3 standard defines the frame format, and two variants exist: the original Ethernet II (DIX) frame and the IEEE 802.3 frame with an LLC (Logical Link Control) sublayer. For CCNA, you must know the Ethernet II frame format, which is the most common on modern networks.
Why Does the Frame Structure Matter?
Every device that communicates over Ethernet — PCs, switches, routers, servers — must construct and interpret frames exactly as specified. If a frame is malformed (e.g., wrong length, corrupted FCS), the receiving device will drop it. Understanding the fields allows you to:
Read a packet capture and identify source/destination MAC addresses.
Determine which protocol is encapsulated (IPv4, IPv6, ARP) using the EtherType field.
Troubleshoot connectivity issues by checking for runt frames (< 64 bytes) or giant frames (> 1518 bytes).
Understand how switches forward frames based on MAC addresses.
Ethernet Frame Fields (Ethernet II)
An Ethernet II frame consists of the following fields in order:
Preamble (7 bytes): A pattern of alternating 1s and 0s (10101010 repeated 7 times) that synchronizes the receiver's clock. It is not part of the frame proper but is sent before the frame.
Start Frame Delimiter (SFD) (1 byte): The byte 10101011 signals the start of the frame. The last two bits (11) indicate that the next byte is the destination MAC.
Destination MAC Address (6 bytes): The MAC address of the intended recipient. Can be unicast, multicast, or broadcast (FF:FF:FF:FF:FF:FF).
Source MAC Address (6 bytes): The MAC address of the sending device.
EtherType (2 bytes): Identifies the protocol encapsulated in the payload. Common values: 0x0800 (IPv4), 0x86DD (IPv6), 0x0806 (ARP). For IEEE 802.3 frames, this field is replaced by a Length field (value ≤ 1500), and an LLC header follows.
Payload (46–1500 bytes): The encapsulated Layer 3 packet. The minimum payload size is 46 bytes to ensure the frame is at least 64 bytes total (excluding preamble). If the payload is less than 46 bytes, padding is added.
Frame Check Sequence (FCS) (4 bytes): A CRC-32 checksum computed over the destination MAC, source MAC, EtherType/Length, and payload. The receiver recalculates the CRC; if it does not match, the frame is discarded.
Frame Size Constraints
Minimum frame size: 64 bytes (from destination MAC through FCS). This ensures that collisions are detected before the sender finishes transmitting. If the payload is less than 46 bytes, padding (zeros) is added.
Maximum frame size: 1518 bytes (standard Ethernet). For 802.1Q VLAN tagging, an additional 4 bytes are inserted, making the maximum 1522 bytes. Jumbo frames (up to 9000 bytes) are supported on some networks but are beyond CCNA scope.
Runt frames: Frames smaller than 64 bytes are considered runts and are discarded by receiving devices.
Giant frames: Frames larger than 1518 bytes (or 1522 with tagging) are considered giants and are discarded.
How Switches Use the Frame
When a switch receives a frame: 1. It checks the FCS; if the CRC is invalid, the frame is dropped. 2. It examines the source MAC address and updates its MAC address table (CAM table) with the incoming port. 3. It looks up the destination MAC address in the MAC address table:
- If found, it forwards the frame out the corresponding port (unicast forwarding). - If not found, it floods the frame out all ports except the incoming port. - If the destination is a broadcast or multicast address, it floods the frame. 4. The switch does not modify the frame fields (except possibly adding a VLAN tag in trunking).
Verification Commands
To see MAC address tables on a Cisco switch:
Switch# show mac address-table
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 0050.7966.6800 DYNAMIC Gi0/1
1 0050.7966.6801 DYNAMIC Gi0/2To see interface counters including runt and giant frames:
Switch# show interfaces gigabitEthernet 0/1
GigabitEthernet0/1 is up, line protocol is up
Hardware is Gigabit Ethernet, address is 0050.7966.6800 (bia 0050.7966.6800)
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is RJ45
output flow-control is unsupported, input flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped outInteraction with Higher Layers
The Ethernet frame is the final encapsulation before bits are placed on the wire. The network layer (IP) packet is placed inside the payload. The EtherType field tells the receiving device to hand the payload to the correct protocol handler (e.g., IPv4, IPv6, ARP). If the EtherType is unknown, the frame is dropped. This is why a switch does not care about IP addresses — it only looks at MAC addresses.
Key Timers and Defaults
No timers are associated with the frame structure itself, but the interframe gap (IFG) is 96 bit times (12 bytes at 10 Mbps, proportionally less at higher speeds).
The minimum frame size (64 bytes) is critical for collision detection in half-duplex Ethernet. In full-duplex, collisions are impossible, but the minimum size remains for compatibility.
The maximum frame size (1518 bytes) prevents one station from monopolizing the medium.
Common Exam Traps
Confusing preamble with frame: The preamble and SFD are not counted in the frame size. They are part of the physical layer.
EtherType vs. Length: In Ethernet II, the field after source MAC is EtherType (value > 1536 decimal, 0x0600). In IEEE 802.3, it is Length (value ≤ 1500). CCNA expects Ethernet II.
Minimum payload: 46 bytes, not 64. The total frame minimum is 64 bytes (18 bytes header + 46 payload + 4 FCS).
FCS calculation: The FCS covers only the frame fields (destination MAC through payload), not the preamble or SFD.
Capture a Frame Using Wireshark
Use Wireshark or tcpdump to capture a live Ethernet frame. On a PC, start a capture on the network interface and generate traffic (e.g., ping a gateway). Filter for 'eth.type == 0x0800' to see IPv4 frames. Double-click a packet and expand the Ethernet II section. You will see the destination MAC, source MAC, and EtherType. The payload is displayed as the IP packet. Note that Wireshark does not show the preamble/SFD or the FCS (they are stripped by the NIC). This step confirms the frame structure in real traffic.
Identify Frame Fields in a Capture
In the Wireshark Ethernet II details, note the 6-byte destination MAC (e.g., 00:1a:2b:3c:4d:5e). The source MAC follows (e.g., 00:5e:4d:3c:2b:1a). The EtherType is shown as 'Type: IPv4 (0x0800)'. The payload is the IP packet. The frame length at the bottom of the window includes the 14-byte header (12 bytes MAC + 2 bytes EtherType) plus payload plus FCS (4 bytes). For a standard 64-byte frame, the payload is 46 bytes. Verify the minimum size by checking the 'Frame length' field.
Verify Frame Counters on a Cisco Switch
Log into a Cisco switch and enter privileged EXEC mode. Use the command `show interfaces gigabitEthernet 0/1` (replace interface as needed). Look for 'runts' and 'giants' counters. A non-zero value indicates frames below 64 bytes or above 1518 bytes. Also check 'CRC' and 'frame' errors. Run `show interfaces` to see all interfaces. To clear counters, use `clear counters` (may require confirmation). This step helps diagnose physical layer issues.
Check MAC Address Table
On a switch, use `show mac address-table` to see dynamically learned MAC addresses. Each entry shows VLAN, MAC address, type (DYNAMIC/STATIC), and port. This table is built from source MAC addresses of incoming frames. If a frame arrives with an unknown source MAC, the switch adds it. If the destination MAC is unknown, the switch floods the frame. Use `show mac address-table aging-time` to see the default aging time (300 seconds). This step demonstrates how switches use frame addressing.
Calculate Minimum Frame Size
Given a payload of 20 bytes, calculate the total frame size. Frame size = 14 bytes header (6+6+2) + payload + 4 bytes FCS = 14 + 20 + 4 = 38 bytes. This is below the 64-byte minimum, so padding of 26 bytes is added to make the payload 46 bytes. Final frame size = 14 + 46 + 4 = 64 bytes. This step reinforces the minimum size rule and padding concept.
Examine an ARP Frame
Capture an ARP request (EtherType 0x0806). An ARP frame has a 14-byte Ethernet header, then the ARP payload (28 bytes for IPv4 ARP). Total frame = 14 + 28 + 4 = 46 bytes, which is below 64, so padding of 18 bytes is added. In Wireshark, you will see the ARP packet and the padding (usually zeros). This highlights that even control protocols must respect the minimum frame size.
In enterprise networks, understanding the Ethernet frame structure is essential for troubleshooting and performance tuning. Consider a scenario where a network engineer notices intermittent connectivity between two switches. Using show interfaces, they see a high number of runts on a specific port. Investigating further, they discover a faulty cable that causes signal degradation, resulting in frames shorter than 64 bytes. By replacing the cable, the runt count stops increasing, and connectivity stabilizes. This is a common real-world problem that frame analysis solves.
Another scenario involves VLAN tagging. When a switch needs to carry multiple VLANs over a single link (trunk), it inserts a 4-byte 802.1Q tag between the source MAC and EtherType/Length fields. This increases the maximum frame size to 1522 bytes. If a device on the trunk expects standard 1518-byte frames, it may drop the larger frames as giants. The engineer must ensure all devices on the trunk support the extended frame size. This is often seen when connecting older switches or NICs that do not support 802.1Q.
A third scenario is jumbo frames in data centers. Storage traffic (e.g., iSCSI) benefits from larger payloads (up to 9000 bytes) to reduce overhead. The engineer must configure the MTU on all devices along the path to 9000 bytes. If one device has a standard MTU of 1500, it will fragment the IP packet or drop the frame if fragmentation is disabled. Troubleshooting involves checking interface MTU settings with show interfaces and verifying that no device drops giant frames.
Misconfiguration of the frame size can cause silent packet loss. For example, if a router is configured with an MTU of 1500 but receives a frame with a 9000-byte payload from a switch, the router will drop the frame (if DF bit is set) or fragment it (if allowed). This leads to performance degradation. The engineer must ensure consistent MTU across the path, often using ping with the DF bit set and varying packet sizes to find the path MTU.
The CCNA 200-301 exam tests Objective 1.3: 'Describe the Ethernet frame structure.' You must know the Ethernet II frame fields: preamble (7 bytes), SFD (1 byte), destination MAC (6 bytes), source MAC (6 bytes), EtherType (2 bytes), payload (46-1500 bytes), and FCS (4 bytes). The exam will not ask for the preamble/SFD in the frame size calculation. Common wrong answers include:
Including preamble in frame size: Many candidates think the frame size includes the preamble (8 bytes). The preamble and SFD are physical layer overhead, not part of the frame. The minimum frame size is 64 bytes from destination MAC to FCS.
Confusing EtherType with Length: Some candidates think the EtherType field always indicates length. In Ethernet II, it is always a protocol type (> 1536). In IEEE 802.3, it is length (≤ 1500). The exam uses Ethernet II, so EtherType is always > 0x0600.
Incorrect minimum payload: Candidates often say the minimum payload is 64 bytes. It is 46 bytes because the total frame must be at least 64 bytes, and the header + FCS is 18 bytes (14+4). So 64 - 18 = 46.
FCS covers entire frame including preamble: The FCS covers only the frame fields (destination MAC through payload). Preamble and SFD are not included.
Exam Tip: For scenario questions where a frame is dropped, check the frame size. If the payload is 40 bytes, the frame size is 14+40+4=58 bytes, which is a runt. If the payload is 1501 bytes, the frame is 14+1501+4=1519 bytes, a giant. Always calculate the total frame size.
Decision rule: When asked about frame fields, identify whether the question refers to Ethernet II or 802.3. If no mention, assume Ethernet II. For EtherType, if the value is 0x0800, it is IPv4. For ARP, it is 0x0806.
Ethernet II frame fields: Preamble (7B), SFD (1B), Dest MAC (6B), Src MAC (6B), EtherType (2B), Payload (46-1500B), FCS (4B).
Minimum frame size: 64 bytes (including FCS). Minimum payload: 46 bytes (padding added if needed).
Maximum standard frame size: 1518 bytes; with 802.1Q tag: 1522 bytes.
EtherType values: 0x0800 (IPv4), 0x86DD (IPv6), 0x0806 (ARP).
FCS uses CRC-32 and covers only destination MAC through payload.
Preamble and SFD are physical layer fields, not part of the frame.
Switches use destination MAC for forwarding; they do not modify frame fields (except VLAN tagging).
These come up on the exam all the time. Here's how to tell them apart.
Ethernet II Frame
Uses EtherType field (2 bytes) after source MAC
EtherType values > 1536 (0x0600)
Most common on modern networks
No LLC header
Used for IP, ARP, etc.
IEEE 802.3 Frame with LLC
Uses Length field (2 bytes) after source MAC
Length values ≤ 1500
Less common, used in some legacy networks
Includes LLC (DSAP, SSAP, Control) and SNAP header
Used for protocols like NetBIOS, IPX
Mistake
The preamble is part of the frame size calculation.
Correct
The preamble (7 bytes) and SFD (1 byte) are physical layer overhead and are not counted in the frame size. The frame size includes only destination MAC through FCS.
Candidates often include all bytes before the payload, but the preamble/SFD are not part of the Layer 2 frame.
Mistake
The minimum payload is 64 bytes.
Correct
The minimum payload is 46 bytes. The total frame minimum is 64 bytes, but the header (14 bytes) and FCS (4 bytes) account for 18 bytes, leaving 46 bytes for payload.
Candidates confuse the total frame size with the payload size.
Mistake
The EtherType field always indicates the length of the payload.
Correct
In Ethernet II, the EtherType field indicates the protocol type (e.g., IPv4). In IEEE 802.3, it is a length field. CCNA focuses on Ethernet II, so it is always a protocol type.
Candidates may recall the 802.3 format from other studies and apply it incorrectly.
Mistake
The FCS covers the entire frame including the preamble.
Correct
The FCS covers only the fields from destination MAC through payload. The preamble and SFD are not included in the CRC calculation.
Candidates think the FCS protects the entire transmission, but it only protects the frame fields.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A runt frame is smaller than 64 bytes (the minimum Ethernet frame size). A giant frame is larger than 1518 bytes (or 1522 with VLAN tagging). Both are considered errors and are dropped by receiving devices. Runts often result from collisions or faulty hardware; giants can occur if a device's MTU is misconfigured. On Cisco switches, you can check for runts and giants using `show interfaces`.
No. The FCS (Frame Check Sequence) is a 4-byte CRC-32 that covers only the fields from the destination MAC address through the payload (including any padding). The preamble and Start Frame Delimiter are physical layer fields and are not included in the CRC calculation. If the FCS is incorrect, the frame is discarded at the data link layer.
Padding ensures that the frame meets the minimum size requirement of 64 bytes. If the payload is less than 46 bytes, the sender adds zeros (or other data) to bring the total payload to 46 bytes. This is necessary for collision detection in half-duplex Ethernet, but is maintained in full-duplex for compatibility. The padding is not part of the upper-layer data and is removed by the receiving host after the frame is processed.
When a switch receives a frame, it examines the source MAC address and updates its MAC address table (CAM table) by associating that MAC with the incoming port. This allows the switch to know which port to use for future frames destined to that MAC. If the source MAC is already in the table on a different port, the switch may update the entry (if the new port is different) to reflect the most recent location.
No, a single Ethernet frame carries exactly one protocol in its payload, identified by the EtherType field. For example, if EtherType is 0x0800, the payload is an IPv4 packet. If it is 0x0806, the payload is an ARP message. The receiver uses the EtherType to pass the payload to the correct upper-layer protocol handler. Multiplexing of multiple protocols happens at higher layers (e.g., IP can carry TCP and UDP).
The interframe gap is a 96-bit time (12 bytes at 10 Mbps) idle period between Ethernet frames. It allows devices to synchronize and prepare for the next frame. The IFG is not part of the frame; it is a physical layer spacing. Without it, devices could not distinguish between consecutive frames. On faster Ethernet speeds, the time is proportionally shorter, but the bit count remains 96 bits.
802.1Q inserts a 4-byte tag between the source MAC and EtherType/Length fields. The tag contains a Tag Protocol Identifier (TPID) of 0x8100 and a Tag Control Information (TCI) field that includes the VLAN ID (12 bits) and priority (3 bits). This increases the maximum frame size from 1518 to 1522 bytes. The FCS is recalculated to include the tag. Devices that do not support 802.1Q may drop these frames as giants.
You've just covered Ethernet Frame Structure — now see how well it sticks with free CCNA 200-301 practice questions. Full explanations included, no account needed.
Done with this chapter?