Ethernet frames and MAC addresses
On a local network, data travels in Ethernet frames, and every frame is addressed with MAC addresses. Watch your laptop build one real 64-byte frame field by field, send it down a shared wire, and see which cards keep it, which drop it, and why a damaged frame never gets through.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01How long is a MAC address?
A MAC address is 48 bits (6 bytes), usually written like 00:00:5e:00:53:01. 32 bits with decimal numbers is an IPv4 address; 128 bits is IPv6.
02Why does the destination MAC come before the source MAC in a frame?
Right after the preamble and SFD, each card reads the destination and can stop paying attention if the frame isn't for it.
03On a shared segment, the printer receives a frame addressed to 00:00:5e:00:53:02. Its own MAC is 00:00:5e:00:53:03. What does it do?
A card keeps a frame only if the destination is its own MAC or the broadcast address (or a multicast group it joined). Anything else is quietly dropped.
04A frame arrives, but the CRC-32 the receiver computes does not match the FCS. What happens?
The FCS only detects damage; it cannot repair it. Ethernet drops the frame and does not resend, so recovery is up to protocols like TCP.
05Which EtherType tells the receiver the payload is an ARP message?
0x0806 is ARP, 0x0800 is IPv4 and 0x86DD is IPv6.
Glossary
- NIC
- Network interface card: the part of a device that connects it to the network. Each one has its own MAC address.
- MAC address
- A 48-bit hardware address, written as six hex pairs like 00:00:5e:00:53:01, used to deliver frames on a local network.
- OUI
- Organizationally Unique Identifier: the first three bytes of a MAC address, assigned by the IEEE to a maker or organisation.
- Ethernet frame
- One unit of data on an Ethernet network: destination and source MAC, EtherType, payload and FCS, led by a preamble and SFD.
- Preamble and SFD
- Seven bytes of 10101010 followed by 10101011. They let the receiver lock on and mark where the frame starts.
- EtherType
- Two bytes that say what the payload is, such as 0x0800 for IPv4 or 0x0806 for ARP.
- FCS
- Frame check sequence: a 4-byte CRC-32 the receiver recomputes to detect damaged frames.
- Broadcast
- The address ff:ff:ff:ff:ff:ff (all 48 bits set). Every card on the segment keeps a broadcast frame.
Notes and sources
- MAC addresses 00:00:5e:00:53:01 to 00:00:5e:00:53:03 come from the 00:00:5e:00:53:xx block that RFC 7042 (now RFC 9542) sets aside for documentation; 192.168.1.0/24 is private home-network space (RFC 1918).
- The IEEE Registration Authority assigns each OUI; 00:00:5e belongs to IANA. Makers number the last three bytes themselves.
- The lowest bit of the first byte marks a group address. Cards also keep multicast frames for groups they have joined, and a card in promiscuous mode keeps everything; that is how packet sniffers work.
- A hub, or an old shared coax cable, repeats every frame to every card. Modern networks use switches, which send a frame only toward the port where its destination lives.
- This example frame is real: a 33-byte IPv4/UDP packet carrying "hello", padded to 46 bytes, with FCS 0x0ffbb8c5 computed from its bytes.
Quiz Unlocks after the last step.