Ethernet frames and MAC addresses: structure, types and how to read them
In short: Every packet on a wired LAN travels inside an Ethernet frame. The frame carries destination and source MAC addresses, a type field that says what is inside, the data, and a checksum. MAC addresses identify interfaces on the local link only; IP addresses take over beyond it.
What a frame does
An IP packet cannot travel along a cable by itself. At Layer 2 it is wrapped in a frame, which adds the local delivery details: which interface on this link should receive it, which interface sent it, and a checksum to catch damage on the way. Every switch reads the frame header; routers remove the frame, look at the packet inside and build a brand-new frame for the next link.
Almost all wired LANs today use the Ethernet II frame format, standardised within IEEE 802.3.
The fields one by one
| Field | Size | Purpose |
|---|---|---|
| Preamble and start frame delimiter | 8 bytes | A bit pattern that lets the receiver lock on to the signal. Not counted in the frame size. |
| Destination MAC | 6 bytes | The interface (or group) that should receive the frame. Comes first so switches can start deciding early. |
| Source MAC | 6 bytes | The sending interface. Switches learn from this field. |
| 802.1Q tag (optional) | 4 bytes | Carries the VLAN ID and priority on trunk links. |
| EtherType | 2 bytes | What the payload is: 0x0800 IPv4, 0x86DD IPv6, 0x0806 ARP, 0x8100 means a VLAN tag follows. |
| Payload | 46 to 1500 bytes | The packet. Short packets are padded up to 46 bytes. |
| Frame check sequence (FCS) | 4 bytes | A CRC calculated over the frame. A mismatch means the frame was damaged and it is dropped. |
That gives a minimum frame of 64 bytes and a normal maximum of 1518 bytes (1522 with a VLAN tag). The 1500-byte payload limit is the familiar Ethernet MTU. Frames smaller than 64 bytes are runts; frames larger than the maximum, without jumbo frames enabled, are giants. Both show up in interface error counters.
Inside a MAC address
A MAC address is 48 bits, written as six pairs of hexadecimal digits, for example 00:1A:2B:3C:4D:5E (Cisco writes it 001a.2b3c.4d5e). The first 24 bits are the OUI (organisationally unique identifier) that the IEEE assigns to a manufacturer; the last 24 bits are chosen by that manufacturer. You can look up the vendor with the MAC address tool.
- Unicast: one interface. The lowest bit of the first byte is 0.
- Multicast: a group of interfaces. The lowest bit of the first byte is 1, for example
01:00:5E:..for IPv4 multicast or33:33:..for IPv6 multicast. - Broadcast: every device in the broadcast domain,
FF:FF:FF:FF:FF:FF.
The second-lowest bit of the first byte marks a locally administered address. Phones and laptops now use randomised, locally administered MACs on Wi-Fi to protect privacy, which is why a MAC address is no longer a reliable way to identify a person's device.
MAC addresses versus IP addresses
MAC addresses only matter on the current link. As a packet crosses three routers, the source and destination IP addresses stay the same, but the frame (and its MAC addresses) is rebuilt on every hop. To find the MAC that matches an IP address on the local network, IPv4 uses ARP and IPv6 uses Neighbour Discovery.
Real-world example: a user reports slow file copies. show interfaces on the switch shows thousands of CRC errors on their port while the PC side looks clean. CRC errors mean frames arrived damaged, so the fix is physical: a crushed patch lead was replaced and the errors stopped.
Security note: MAC addresses are easy to change in software, so never treat them as proof of identity. Use 802.1X and port security for access control.
Practice
A frame has EtherType 0x86DD. What is inside it?
Is 01:00:5E:00:00:05 unicast, multicast or broadcast?
A packet crosses two routers. Which addresses change at each hop?
Key takeaways
- An Ethernet frame wraps a packet with destination MAC, source MAC, EtherType, payload and FCS.
- Normal frames are 64 to 1518 bytes; the payload (MTU) is up to 1500 bytes.
- A MAC is 48 bits: a 24-bit vendor OUI plus a 24-bit device part.
- MAC addresses are local to one link; frames are rebuilt at every router.
- CRC errors point to physical problems such as bad cables or ports.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.