Ethernet frame
Encyclopedia
A data packet on an Ethernet
Ethernet
Ethernet is a family of computer networking technologies for local area networks commercially introduced in 1980. Standardized in IEEE 802.3, Ethernet has largely replaced competing wired LAN technologies....

 link is called an Ethernet frame. A frame begins with Preamble and Start Frame Delimiter. Following which, each Ethernet frame continues with an Ethernet header featuring destination and source MAC address
MAC address
A Media Access Control address is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used for numerous network technologies and most IEEE 802 network technologies, including Ethernet...

es. The middle section of the frame is payload data including any headers for other protocols (e.g. Internet Protocol
Internet Protocol
The Internet Protocol is the principal communications protocol used for relaying datagrams across an internetwork using the Internet Protocol Suite...

) carried in the frame. The frame ends with a 32-bit cyclic redundancy check
Cyclic redundancy check
A cyclic redundancy check is an error-detecting code commonly used in digital networks and storage devices to detect accidental changes to raw data...

 which is used to detect any corruption of data in transit.

Structure

A data packet on the wire is called a frame and consists of binary data. A frame viewed on the physical wire would show Preamble and Start Frame Delimiter, in addition to the other data. These are required by all physical hardware.Preamble and Start Frame Delimiter are not displayed by packet sniffing software because these bits are stripped away at OSI Layer 1 by the Ethernet adapter before being passed on to the OSI Layer 2 which is where packet sniffers collect their data from. There are OSI Physical Layer sniffers which can capture and display the Preamble and Start Frame but they are expensive and mainly used to detect physical related problems.

The table below shows the complete Ethernet frame, as transmitted, for the MTU
Maximum transmission unit
In computer networking, the maximum transmission unit of a communications protocol of a layer is the size of the largest protocol data unit that the layer can pass onwards. MTU parameters usually appear in association with a communications interface...

 of 1500 octets
Octet (computing)
An octet is a unit of digital information in computing and telecommunications that consists of eight bits. The term is often used when the term byte might be ambiguous, as there is no standard for the size of the byte.-Overview:...

 (some implementations of gigabit Ethernet
Gigabit Ethernet
Gigabit Ethernet is a term describing various technologies for transmitting Ethernet frames at a rate of a gigabit per second , as defined by the IEEE 802.3-2008 standard. It came into use beginning in 1999, gradually supplanting Fast Ethernet in wired local networks where it performed...

 and higher speeds support larger jumbo frames).The bit patterns in the preamble and start of frame delimiter are written as bit strings, with the first bit transmitted on the left (not as byte values, which in Ethernet are transmitted least significant bit(s) first). This notation matches the one used in the IEEE 802.3 standard. One octet is eight bits of data (i.e., a byte on most modern computers).
802.3 Ethernet frame structure
Preamble Start of frame delimiter MAC destination MAC source 802.1Q tag (optional) Ethertype
EtherType
EtherType is a two-octet field in an Ethernet frame. It is used to indicate which protocol is encapsulated in the PayLoad of an Ethernet Frame. This field was first defined by the Ethernet II framing networking standard, and later adapted for the IEEE 802.3 Ethernet networking standard.EtherType...

 or length
Payload Frame check sequence
Frame Check Sequence
A frame check sequence refers to the extra checksum characters added to a frame in a communication protocol for error detection and correction. Frames are used to send upper-layer data and ultimately the user application data from a source to a destination. The data package includes the message...

 (32-bit CRC
Cyclic redundancy check
A cyclic redundancy check is an error-detecting code commonly used in digital networks and storage devices to detect accidental changes to raw data...

)
Interframe gap
Interframe gap
Ethernet devices must allow a minimum idle period between transmission of Ethernet frames known as the interframe gap , interframe spacing, or interpacket gap . A brief recovery time between frames allows devices to prepare for reception of the next frame...

7 octet
Octet (computing)
An octet is a unit of digital information in computing and telecommunications that consists of eight bits. The term is often used when the term byte might be ambiguous, as there is no standard for the size of the byte.-Overview:...

s of 10101010
1 octet of 10101011 6 octets 6 octets (4 octets) 2 octets 12 octets

Preamble and Start Frame Delimiter

The Start Frame Delimiter (SFD) is the 8-bit (1-byte) value marking the end of the preamble of an Ethernet frame. The SFD is immediately followed by the destination MAC address. It has the value 10101011.
The preamble of an Ethernet frame consists of a 56-bit (7-byte) pattern of alternating 1 and 0 bits, which allows devices on the network to easily detect a new incoming frame. The SFD is designed to break this pattern, and signal the start of the actual frame.

10/100M transceiver chips (MII
Media Independent Interface
The Media Independent Interface was originally defined as a standard interface used to connect a Fast Ethernet MAC-block to a PHY chip.The MII design has been extended to support reduced signals and increases speeds...

 PHY
PHY
PHY is an abbreviation for the physical layer of the OSI model.An instantiation of PHY connects a link layer device to a physical medium such as an optical fiber or copper cable. A PHY device typically includes a Physical Coding Sublayer and a Physical Medium Dependent layer. The PCS encodes and...

) work with 4-bits (one nibble
Nibble
In computing, a nibble is a four-bit aggregation, or half an octet...

) at a time. Therefore the preamble will consist of 7 instances of 0101 + 0101, and the Start Frame Delimiter 0101 + 1101. 8-bit values are sent low 4-bit first and then high 4-bit. 1000M transceiver chips (GMII) work with 8-bits at a time, and 10 Gbit/s (XGMII) PHY works with 32-bits at a time. Note that when using octets, first 7 octets of 01010101 are sent, and then one octet of 11010101. But because the low 4-bit nibble 0101 is sent first, and later the high 4-bit nibble 1101, the Start-of-frame sequence 1101 will be sent after the preamble not before the last 4-bits of the preamble as one might otherwise be led to believe. Don't forget that there are differences between DIX V2.0 (Ethernet 2) & IEEE 802.3 In the Frame format.

Header

The header features source and destination MAC addresses which have 48-bits (6 bytes) each, the Ethertype protocol identifier field and optional IEEE 802.1Q
IEEE 802.1Q
IEEE 802.1Q is the networking standard that supports Virtual LANs on an Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying procedures to be used by bridges and switches in handling such frames...

 VLAN tag indicating VLAN membership and traffic priority.

EtherType or Length

This is a two-octet (2 bytes) field in an Ethernet frame. It is used to indicate which protocol is encapsulated in the Payload of an Ethernet Frame.

Payload or data of an Ethernet frame

The minimum frame payload is 368 bit(46 Bytes) (dictated by the slot time of the Ethernet LAN architecture). The maximum frame payload is 12000 (1500 Bytes), which is achieved by a single transmitting node which does not therefore suffer

Frame check sequence

The frame check sequence (CRC) is a 32-bit(4 bytes) cyclic redundancy check which enables detection of corrupted data within the entire frame.

Interframe gap

After a frame has been sent, transmitters are required to transmit a minimum of 96 bits (12 octets) of idle line state before transmitting the next frame.

Ethernet frame types

There are several types of Ethernet frames. The different frame types have different formats and MTU values, but can coexist on the same physical medium.
  • The Ethernet Version 2A version 1 Ethernet frame was used for early Ethernet prototypes and featured 8-bit MAC addresses and was never commercially deployed. or Ethernet II frame or DIX frame is the most common type in use today, as it is often used directly by the Internet Protocol.
  • Novell
    Novell
    Novell, Inc. is a multinational software and services company. It is a wholly owned subsidiary of The Attachmate Group. It specializes in network operating systems, such as Novell NetWare; systems management solutions, such as Novell ZENworks; and collaboration solutions, such as Novell Groupwise...

    's non-standard variation of raw IEEE 802.3
    IEEE 802.3
    IEEE 802.3 is a working group and a collection of IEEE standards produced by the working group defining the physical layer and data link layer's media access control of wired Ethernet. This is generally a local area network technology with some wide area network applications...

     frame
  • IEEE 802.2
    IEEE 802.2
    IEEE 802.2 is the IEEE 802 standard defining Logical Link Control , which is the upper portion of the data link layer of the OSI Model. The LLC sublayer presents a uniform interface to the user of the data link service, usually the network layer...

     Logical Link Control
    Logical Link Control
    The logical link control data communication protocol layer is the upper sub-layer of the data link layer in the seven-layer OSI reference model...

     (LLC) frame
  • Subnetwork Access Protocol
    Subnetwork Access Protocol
    The Subnetwork Access Protocol is a mechanism for multiplexing, on networks using IEEE 802.2 LLC, more protocols than can be distinguished by the 8-bit 802.2 Service Access Point fields. SNAP supports identifying protocols by Ethernet type field values; it also supports vendor-private protocol...

     (SNAP) frame


In addition, all four Ethernet frames types may optionally contain a IEEE 802.1Q tag to identify what VLAN
Virtual LAN
A virtual local area network, virtual LAN or VLAN, is a group of hosts with a common set of requirements that communicate as if they were attached to the same broadcast domain, regardless of their physical location...

 it belongs to and its IEEE 802.1p
IEEE 802.1p
IEEE P802.1p is the name of a task group active during 1995–98 responsible for adding traffic class expediting and dynamic multicast filtering to the IEEE 802.1D standard. Essentially, they provided a mechanism for implementing Quality of Service at the Media Access Control level...

 priority (quality of service
Quality of service
The quality of service refers to several related aspects of telephony and computer networks that allow the transport of traffic with special requirements...

). This encapsulation is defined in the IEEE 802.3ac specification and increases the maximum frame by 4 bytes.

The IEEE 802.1Q tag, if present, is placed between the Source Address and the EtherType or Length fields. The first two bytes of the tag are the Tag Protocol Identifier (TPID) value of 0x8100. This is located in the same place as the EtherType/Length field in untagged frames, so an EtherType value of 0x8100 means the frame is tagged, and the true EtherType/Length is located after the Q-tag. The TPID is followed by two bytes containing the Tag Control Information (TCI) (the IEEE 802.1p priority (quality of service
Quality of service
The quality of service refers to several related aspects of telephony and computer networks that allow the transport of traffic with special requirements...

) and VLAN
Virtual LAN
A virtual local area network, virtual LAN or VLAN, is a group of hosts with a common set of requirements that communicate as if they were attached to the same broadcast domain, regardless of their physical location...

 id). The Q-tag is followed by the rest of the frame, using one of the types described above.

Ethernet II

Ethernet II framing (also known as DIX Ethernet, named after DEC
Digital Equipment Corporation
Digital Equipment Corporation was a major American company in the computer industry and a leading vendor of computer systems, software and peripherals from the 1960s to the 1990s...

, Intel and Xerox
Xerox
Xerox Corporation is an American multinational document management corporation that produced and sells a range of color and black-and-white printers, multifunction systems, photo copiers, digital production printing presses, and related consulting services and supplies...

, the major participants in its design), defines the two-octet EtherType
EtherType
EtherType is a two-octet field in an Ethernet frame. It is used to indicate which protocol is encapsulated in the PayLoad of an Ethernet Frame. This field was first defined by the Ethernet II framing networking standard, and later adapted for the IEEE 802.3 Ethernet networking standard.EtherType...

 field in an Ethernet frame, preceded by destination and source MAC addresses, that identifies an upper layer protocol
Upper layer protocol
In computer networking, the term upper layer protocol refers to a more abstract protocol when performing encapsulation, in particular it is often used to describe the protocols above the network layer....

 encapsulating
Encapsulation (networking)
In computer networking, encapsulation is a method of designing modular communication protocols in which logically separate functions in the network are abstracted from their underlying structures by inclusion or information hiding within higher level objects....

 the frame data. For example, an EtherType value of 0x0800 signals that the frame contains an IPv4
IPv4
Internet Protocol version 4 is the fourth revision in the development of the Internet Protocol and the first version of the protocol to be widely deployed. Together with IPv6, it is at the core of standards-based internetworking methods of the Internet...

 datagram. Likewise, an EtherType of 0x0806 indicates an ARP
Address Resolution Protocol
Address Resolution Protocol is a telecommunications protocol used for resolution of network layer addresses into link layer addresses, a critical function in multiple-access networks. ARP was defined by RFC 826 in 1982. It is Internet Standard STD 37...

 frame, 0x8100 indicates an IEEE 802.1Q frame and 0x86DD indicates an IPv6
IPv6
Internet Protocol version 6 is a version of the Internet Protocol . It is designed to succeed the Internet Protocol version 4...

 frame.

As this industry-developed standard went through a formal IEEE standardization process, the EtherType field was changed to a (data) length field in the new 802.3 standard.Original Ethernet packets define their length with the framing that surrounds it, rather than with an explicit length count. Since the packet recipient still needs to know how to interpret the packet, the standard required an IEEE 802.2 header to follow the length and specify the packet type. Many years later, the 802.3x-1997 standard, and later versions of the 802.3 standard, formally approved of both types of framing. In practice, both formats are in wide use, with original Ethernet framing the most common in Ethernet local area networks, due to its simplicity and lower overhead.

In order to allow some packets using Ethernet v2 framing and some packets using the original version of 802.3 framing to be used on the same Ethernet segment, EtherType values must be greater than or equal to 1536 (0x0600). That value was chosen because the maximum length of the data field of an Ethernet 802.3 frame is 1500 bytes (0x05DC). Thus if the field's value is greater than or equal to 1536, the frame must be an Ethernet v2 frame, with that field being a type field. If it's less than or equal to 1500, it must be an IEEE 802.3 frame, with that field being a length field. Values between 1500 and 1536, exclusive, are undefined. This convention allows software to determine whether a frame is an Ethernet II frame or an IEEE 802.3 frame, allowing the coexistence of both standards on the same physical medium.

802.2 LLC

Some protocols, particularly those designed for the OSI stack, operate directly on top of IEEE 802.2 LLC encapsulation, which provides both connection-oriented and connectionless network services.

IEEE 802.2 LLC encapsulation is not in widespread use on common networks currently, with the exception of large corporate NetWare installations that have not yet migrated to NetWare over IP
Internet Protocol
The Internet Protocol is the principal communications protocol used for relaying datagrams across an internetwork using the Internet Protocol Suite...

. In the past, many corporate networks used IEEE 802.2 to support transparent translating bridges between Ethernet and Token Ring or FDDI networks.

There exists an Internet standard
Internet standard
In computer network engineering, an Internet Standard is a normative specification of a technology or methodology applicable to the Internet. Internet Standards are created and published by the Internet Engineering Task Force .-Overview:...

 for encapsulating IPv4 traffic in IEEE 802.2 LLC SAP/SNAP frames. It is almost never implemented on Ethernet, although it is used on FDDI, Token Ring, IEEE 802.11
IEEE 802.11
IEEE 802.11 is a set of standards for implementing wireless local area network computer communication in the 2.4, 3.6 and 5 GHz frequency bands. They are created and maintained by the IEEE LAN/MAN Standards Committee . The base version of the standard IEEE 802.11-2007 has had subsequent...

, and other IEEE 802
IEEE 802
IEEE 802 refers to a family of IEEE standards dealing with local area networks and metropolitan area networks.More specifically, the IEEE 802 standards are restricted to networks carrying variable-size packets. IEEE 802 refers to a family of IEEE standards dealing with local area networks and...

 LANs. IP traffic cannot be encapsulated in IEEE 802.2 LLC frames without SNAP because, although there is a LLC SAP protocol type for IP, there is no such type for ARP
Address Resolution Protocol
Address Resolution Protocol is a telecommunications protocol used for resolution of network layer addresses into link layer addresses, a critical function in multiple-access networks. ARP was defined by RFC 826 in 1982. It is Internet Standard STD 37...

, which is required for operation of any medium to large network. IPv6 can also be transmitted over Ethernet using IEEE 802.2 LLC SAP/SNAP, but, again, that's almost never used.

SNAP
Subnetwork Access Protocol
The Subnetwork Access Protocol is a mechanism for multiplexing, on networks using IEEE 802.2 LLC, more protocols than can be distinguished by the 8-bit 802.2 Service Access Point fields. SNAP supports identifying protocols by Ethernet type field values; it also supports vendor-private protocol...

By examining the 802.2 LLC header, it is possible to determine whether it is followed by a SNAP header. The LLC header includes two additional eight-bit address fields, called service access points (SAPs) in OSI terminology; when both source and destination SAP are set to the value 0xAA, the SNAP service is requested. The SNAP header allows EtherType values to be used with all IEEE 802 protocols, as well as supporting private protocol ID spaces. In IEEE 802.3x-1997, the IEEE Ethernet standard was changed to explicitly allow the use of the 16-bit field after the MAC addresses to be used as a length field or a type field.

Mac OS
Mac OS
Mac OS is a series of graphical user interface-based operating systems developed by Apple Inc. for their Macintosh line of computer systems. The Macintosh user experience is credited with popularizing the graphical user interface...

 uses IEEE 802.2 LLC SAP/SNAP encapsulation for the AppleTalk
AppleTalk
AppleTalk is a proprietary suite of protocols developed by Apple Inc. for networking computers. It was included in the original Macintosh released in 1984, but is now unsupported as of the release of Mac OS X v10.6 in 2009 in favor of TCP/IP networking...

 v2 protocol suite on Ethernet (“EtherTalk”.)

Novell raw 802.3

Novell's "raw" 802.3 frame format was based on early IEEE 802.3 work. Novell used this as a starting point to create the first implementation of its own IPX
IPX
Internetwork Packet Exchange is the OSI-model Network layer protocol in the IPX/SPX protocol stack.The IPX/SPXM protocol stack is supported by Novell's NetWare network operating system. Because of Netware's popularity through the late 1980s into the mid 1990s, IPX became a popular internetworking...

 Network Protocol over Ethernet. They did not use any LLC header but started the IPX packet directly after the length field. This does not conform to the IEEE 802.3 standard, but since IPX has always FF at the first two bytes (while in IEEE 802.2 LLC that pattern is theoretically possible but extremely unlikely), in practice this mostly coexists on the wire with other Ethernet implementations, with the notable exception of some early forms of DECnet
DECnet
DECnet is a suite of network protocols created by Digital Equipment Corporation, originally released in 1975 in order to connect two PDP-11 minicomputers. It evolved into one of the first peer-to-peer network architectures, thus transforming DEC into a networking powerhouse in the 1980s...

 which got confused by this.

Novell NetWare
Novell NetWare
NetWare is a network operating system developed by Novell, Inc. It initially used cooperative multitasking to run various services on a personal computer, with network protocols based on the archetypal Xerox Network Systems stack....

 used this frame type by default until the mid nineties, and since Netware was very widespread back then, while IP was not, at some point in time most of the world's Ethernet traffic ran over "raw" 802.3 carrying IPX. Since Netware 4.10, Netware now defaults to IEEE 802.2 with LLC (Netware Frame Type Ethernet_802.2) when using IPX.

Maximum throughput

We may calculate the protocol efficiency for Ethernet:
Maximum efficiency is achieved with largest allowed payload size and is
for untagged Ethernet packets, since the frame size is maximum 1500 byte payload + 8 byte preamble + 14 byte header + 4 Byte trailer + minimum interframe gap corresponding to 12 bytes = 1538 bytes. The maximum efficiency is
when 802.1Q VLAN tagging is used.

The throughput
Throughput
In communication networks, such as Ethernet or packet radio, throughput or network throughput is the average rate of successful message delivery over a communication channel. This data may be delivered over a physical or logical link, or pass through a certain network node...

 may be calculated from the efficiency:,
where the physical layer net bit rate (the wire bit rate) depends on the Ethernet physical layer
Ethernet physical layer
The Ethernet physical layer is the physical layer component of the Ethernet family of computer network standards.The Ethernet physical layer evolved over a considerable time span and encompasses quite a few physical media interfaces and several magnitudes of speed...

 standard, and may be 10 Mbit/s, 100 Mbit/s, 1 Gbit/s or 10 Gbit/s. Maximum throughput for 100BASE-TX Ethernet is consequently 97.53 Mbit/s without 802.1Q, and 97.28 Mbit/s with 802.1Q.

Channel utilization is concept often confused with protocol efficiency. It considers only the use of the channel disregarding the nature of the data transmitted – either payload or overhead. At the physical layer, the link channel and equipment do not know the difference between data and control frames. We may calculate the link utilization or channel utilization:


The total time considers the round trip time along the channel, the processing time in the hosts and the time transmitting data and acknowledge packets. The time spent transmitting data includes data and acknowledge packets.

Runt frames

A runt frame is an Ethernet frame that is less than the IEEE 802.3 minimum length of 64 bytes. Possible causes are collision, underruns, bad network card or software.
The source of this article is wikipedia, the free encyclopedia.  The text of this article is licensed under the GFDL.
 
x
OK