Ethernet Frames and MAC Addresses

Ethernet delivers on the local link

Ethernet moves data across one local link or switched LAN. A host places an upper-layer packet inside a frame, sends that frame from its network interface, and identifies the next local receiver with a MAC address. A router ends one Ethernet frame and creates another for the next link; Ethernet addresses are not end-to-end Internet addresses.

Think of an IP address as the final street address and a MAC address as the label for the next local delivery. The labels solve different problems, and neither replaces the other.

Read an Ethernet frame

An Ethernet transmission begins with synchronization information, followed by destination and source MAC addresses. The type/length field explains what follows, the payload carries upper-layer data, optional padding satisfies the minimum frame size, and the frame check sequence helps detect corruption.

In common Ethernet II captures, 0x0800 means IPv4, 0x0806 means ARP, and 0x86DD means IPv6. A normal packet capture often omits the preamble, start-frame delimiter, and FCS because the network adapter processes them before software sees the frame.

Understand MAC addresses

A MAC address is normally written as six hexadecimal octets, such as 02:00:00:00:00:0A. It identifies an interface for link-layer delivery. The first octet also carries individual/group and universal/local bits. An OUI can identify an assigned vendor block, but modern devices can use locally administered or randomized addresses.

A MAC address is useful forwarding information—not a trustworthy username, permanent identity, or security boundary.

Unicast, broadcast, multicast and unknown unicast

Unknown unicast is not broadcast. Its destination bit pattern still names one interface; flooding is the switch's temporary forwarding action.

Interactive frame delivery

Choose each address type and follow the frame. The player starts automatically unless your device requests reduced motion. Pause it, move one step at a time, or open the technical packet fields.

Open the Ethernet frame

1. Preamble + SFDSynchronizes the receiver and marks the frame start.
2. Destination MACNames the local-link destination or delivery group.
3. Source MACNames the sending Ethernet interface.
4. EtherType / lengthIdentifies the carried protocol in Ethernet II, or length in IEEE 802.3.
5. PayloadCarries upper-layer data; padding supplies the minimum when needed.
6. Frame check sequenceHelps the receiver detect transmission corruption.

Choose a delivery address

Known unicastBroadcastMulticastUnknown unicast

The switch forwards one copy on Host B's known port. Only the intended destination accepts the frame.

• Sender: eth0↔Switch: Gi0/1
• Switch: Gi0/2↔Host B: eth0
• Switch: Gi0/3↔Host C: eth0

Active: Sender

PreviousPlayNextRestartPlayback speed0.5×1×1.5×2×

Step 1 of 3

The sender builds an Ethernet frame

The destination field is 02:00:00:00:00:0B. The source field identifies the sender's interface.

Packet inspector

Inside the packet

Choose packet inspection depth

Plain-language viewTechnical inspection

Host or device decision

No frame is crossing a link during this step.

Destination MAC

02:00:00:00:00:0B

Source MAC

02:00:00:00:00:0A

EtherType

0x0800 (IPv4)

Technical packet details

Payload

IPv4 packet (46–1500 bytes without VLAN tagging)

FCS

CRC-based error detection