比特派官方app|ethernet packet format

Ethernet frame - Wikipedia

Ethernet frame - Wikipedia

Jump to content

Main menu

Main menu

move to sidebar

hide

Navigation

Main pageContentsCurrent eventsRandom articleAbout WikipediaContact usDonate

Contribute

HelpLearn to editCommunity portalRecent changesUpload file

Search

Search

Create account

Log in

Personal tools

Create account Log in

Pages for logged out editors learn more

ContributionsTalk

Contents

move to sidebar

hide

(Top)

1Structure

Toggle Structure subsection

1.1Ethernet packet – physical layer

1.1.1Preamble and start frame delimiter

1.2Frame – data link layer

1.2.1Header

1.2.2Payload

1.2.3Frame check sequence

1.3End of frame – physical layer

1.4Interpacket gap – physical layer

2Types

Toggle Types subsection

2.1Ethernet II

2.2Novell raw IEEE 802.3

2.3IEEE 802.2 LLC

2.4IEEE 802.2 SNAP

3Maximum throughput

4Runt frames

5Notes

6References

7Further reading

Toggle the table of contents

Ethernet frame

12 languages

CatalàČeštinaDeutschEspañol한국어Bahasa IndonesiaItaliano日本語SvenskaTürkçeTiếng Việt中文

Edit links

ArticleTalk

English

ReadEditView history

Tools

Tools

move to sidebar

hide

Actions

ReadEditView history

General

What links hereRelated changesUpload fileSpecial pagesPermanent linkPage informationCite this pageGet shortened URLDownload QR codeWikidata item

Print/export

Download as PDFPrintable version

From Wikipedia, the free encyclopedia

Unit of data on an Ethernet network

Ethernet packet. The SFD (start frame delimiter) marks the end of the packet preamble. It is immediately followed by the Ethernet frame, which starts with the destination MAC address.[1]

In computer networking, an Ethernet frame is a data link layer protocol data unit and uses the underlying Ethernet physical layer transport mechanisms. In other words, a data unit on an Ethernet link transports an Ethernet frame as its payload.[2]

An Ethernet frame is preceded by a preamble and start frame delimiter (SFD), which are both part of the Ethernet packet at the physical layer. Each Ethernet frame starts with an Ethernet header, which contains destination and source MAC addresses as its first two fields. The middle section of the frame is payload data including any headers for other protocols (for example, Internet Protocol) carried in the frame. The frame ends with a frame check sequence (FCS), which is a 32-bit cyclic redundancy check used to detect any in-transit corruption of data.

Structure[edit]

See also: Physical Coding Sublayer

A data packet on the wire and the frame as its payload consist of binary data. Ethernet transmits data with the most-significant octet (byte) first; within each octet, however, the least-significant bit is transmitted first.[a]

The internal structure of an Ethernet frame is specified in IEEE 802.3.[2] The table below shows the complete Ethernet packet and the frame inside, as transmitted, for the payload size up to the MTU of 1500 octets.[b] Some implementations of Gigabit Ethernet and other higher-speed variants of Ethernet support larger frames, known as jumbo frames.

802.3 Ethernet packet and frame structure

Layer

Preamble

Start frame delimiter (SFD)

MAC destination

MAC source

802.1Q tag (optional)

Ethertype (Ethernet II) or length (IEEE 802.3)

Payload

Frame check sequence (32‑bit CRC)

Interpacket gap (IPG)

Length (octets)

7

1

6

6

(4)

2

42–1500[c]

4

12

Layer 2 Ethernet frame

(not part of the frame)

← 64–1522 octets →

(not part of the frame)

Layer 1 Ethernet packet & IPG

← 72–1530 octets →

← 12 octets →

The optional 802.1Q tag consumes additional space in the frame. Field sizes for this option are shown in brackets in the table above. IEEE 802.1ad (Q-in-Q) allows for multiple tags in each frame. This option is not illustrated here.

Ethernet packet – physical layer[edit]

Preamble and start frame delimiter[edit]

See also: Syncword

An Ethernet packet starts with a seven-octet (56-bit) preamble and one-octet (8-bit) start frame delimiter (SFD).[d] The preamble bit values alternate 1 and 0, allowing receivers to synchronize their clock at the bit-level with the transmitter. The preamble is followed by the SFD which ends with a 1 instead of 0, to break the bit pattern of the preamble and signal the start of the actual frame.[1]: section 4.2.5 

Physical layer transceiver circuitry (PHY for short) is required to connect the Ethernet MAC to the physical medium. The connection between a PHY and MAC is independent of the physical medium and uses a bus from the media independent interface family (MII, GMII, RGMII, SGMII, XGMII). The preamble and SFD representation depends on the width of the bus:

Preamble and SFD representations as bits, decimal, bytes, and nibbles

Representation

56-bit (7-byte) Preamble

SFD byte

uncoded on-the-wire bit pattern transmitted from left to right (used by Ethernet variants transmitting serial bits instead of larger symbols)[1]: sections 4.2.5 and 3.2.2 

10101010

10101010

10101010

10101010

10101010

10101010

10101010

10101011

decimal in Ethernet LSb-first ordering[1]: sections 3.2.2, 3.3 and 4.2.6 

85

85

85

85

85

85

85

213

hexadecimal LSb-first bytes for 8-bit wide busses

(GMII bus for Gigabit Ethernet transceivers)

0x55

0x55

0x55

0x55

0x55

0x55

0x55

0xD5

hexadecimal LSb-first nibbles for 4-bit wide busses (MII bus for Fast Ethernet or RGMII for gigabit transceivers)

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0xD

The SFD is immediately followed by the destination MAC address, which is the first field in an Ethernet frame.

Frame – data link layer[edit]

Header[edit]

The header features destination and source MAC addresses (each six octets in length), the EtherType field and, optionally, an IEEE 802.1Q tag or IEEE 802.1ad tag.

The EtherType field is two octets long and it can be used for two different purposes. Values of 1500 and below mean that it is used to indicate the size of the payload in octets, while values of 1536 and above indicate that it is used as an EtherType, to indicate which protocol is encapsulated in the payload of the frame. When used as EtherType, the length of the frame is determined by the location of the interpacket gap and valid frame check sequence (FCS).

The IEEE 802.1Q tag or IEEE 802.1ad tag, if present, is a four-octet field that indicates virtual LAN (VLAN) membership and IEEE 802.1p priority. The first two octets of the tag are called the Tag Protocol IDentifier (TPID) and double as the EtherType field indicating that the frame is either 802.1Q or 802.1ad tagged. 802.1Q uses a TPID of 0x8100. 802.1ad uses a TPID of 0x88a8.

Payload[edit]

Payload is a variable-length field. Its minimum size is governed by a requirement for a minimum frame transmission of 64 octets (bytes).[e] With header and FCS taken into account, the minimum payload is 42 octets when an 802.1Q tag is present[f] and 46 octets when absent. When the actual payload is less than the minimum, padding octets are added accordingly. IEEE standards specify a maximum payload of 1500 octets. Non-standard jumbo frames allow for larger payloads on networks built to support them.

Frame check sequence[edit]

The frame check sequence (FCS) is a four-octet cyclic redundancy check (CRC) that allows detection of corrupted data within the entire frame as received on the receiver side. According to the standard, the FCS value is computed as a function of the protected MAC frame fields: source and destination address, length/type field, MAC client data and padding (that is, all fields except the FCS).

Per the standard, this computation is done using the left shifting CRC-32 (polynomial = 0x4C11DB7, initial CRC = 0xFFFFFFFF, CRC is post complemented, verify value = 0x38FB2284) algorithm. The standard states that data is transmitted least significant bit (bit 0) first, while the FCS is transmitted most significant bit (bit 31) first.[1]: section 3.2.9  An alternative is to calculate a CRC using the right shifting CRC-32 (polynomial = 0xEDB88320, initial CRC = 0xFFFFFFFF, CRC is post complemented, verify value = 0x2144DF1C), which will result in a CRC that is a bit reversal of the FCS, and transmit both data and the CRC least significant bit first, resulting in identical transmissions.

The standard states that the receiver should calculate a new FCS as data is received and then compare the received FCS with the FCS the receiver has calculated. An alternative is to calculate a CRC on both the received data and the FCS, which will result in a fixed non-zero "verify" value. (The result is non-zero because the CRC is post complemented during CRC generation). Since the data is received least significant bit first, and to avoid having to buffer octets of data, the receiver typically uses the right shifting CRC-32. This makes the "verify" value (sometimes called "magic check") 0x2144DF1C.[5]

However, hardware implementation of a logically right shifting CRC may use a left shifting Linear Feedback Shift Register as the basis for calculating the CRC, reversing the bits and resulting in a verify value of 0x38FB2284. Since the complementing of the CRC may be performed post calculation and during transmission, what remains in the hardware register is a non-complemented result, so the residue for a right shifting implementation would be the complement of 0x2144DF1C = 0xDEBB20E3, and for a left shifting implementation, the complement of 0x38FB2284 = 0xC704DD7B.

End of frame – physical layer[edit]

The end of a frame is usually indicated by the end-of-data-stream symbol at the physical layer or by loss of the carrier signal; an example is 10BASE-T, where the receiving station detects the end of a transmitted frame by loss of the carrier. Later physical layers use an explicit end of data or end of stream symbol or sequence to avoid ambiguity, especially where the carrier is continually sent between frames; an example is Gigabit Ethernet with its 8b/10b encoding scheme that uses special symbols which are transmitted before and after a frame is transmitted.[6][7]

Interpacket gap – physical layer[edit]

Interpacket gap (IPG) is idle time between packets. After a packet has been sent, transmitters are required to transmit a minimum of 96 bits (12 octets) of idle line state before transmitting the next packet.

Types[edit]

Ethernet frame differentiation

Frame type

Ethertype or length

Payload start two bytes

Ethernet II

≥ 1536

Any

Novell raw IEEE 802.3

≤ 1500

0xFFFF

IEEE 802.2 LLC

≤ 1500

Other

IEEE 802.2 SNAP

≤ 1500

0xAAAA

There are several types of Ethernet frames:

Ethernet II frame, or Ethernet Version 2,[g] or DIX frame is the most common type in use today, as it is often used directly by the Internet Protocol.

Novell raw IEEE 802.3 non-standard variation frame

IEEE 802.2 Logical Link Control (LLC) frame

IEEE 802.2 Subnetwork Access Protocol (SNAP) frame

The different frame types have different formats and MTU values, but can coexist on the same physical medium. Differentiation between frame types is possible based on the table on the right.

In addition, all four Ethernet frame types may optionally contain an IEEE 802.1Q tag to identify what VLAN it belongs to and its priority (quality of service). This encapsulation is defined in the IEEE 802.3ac specification and increases the maximum frame by 4 octets.

The IEEE 802.1Q tag, if present, is placed between the Source Address and the EtherType or Length fields. The first two octets of the tag are the Tag Protocol Identifier (TPID) value of 0x8100. This is located in the same place as the EtherType/Length field in untagged frames, so an EtherType value of 0x8100 means the frame is tagged, and the true EtherType/Length is located after the Q-tag. The TPID is followed by two octets containing the Tag Control Information (TCI) (the IEEE 802.1p priority (quality of service) and VLAN id). The Q-tag is followed by the rest of the frame, using one of the types described above.

Ethernet II[edit]

Ethernet II framing (also known as DIX Ethernet, named after DEC, Intel and Xerox, the major participants in its design[8]), defines the two-octet EtherType field in an Ethernet frame, preceded by destination and source MAC addresses, that identifies an upper layer protocol encapsulated by the frame data. Most notably, an EtherType value of 0x0800 indicates that the frame contains an IPv4 datagram, 0x0806 indicates an ARP datagram, and 0x86DD indicates an IPv6 datagram. See EtherType § Values for more.

The most common Ethernet frame format, type II

As this industry-developed standard went through a formal IEEE standardization process, the EtherType field was changed to a (data) length field in the new 802.3 standard.[h] Since the recipient still needs to know how to interpret the frame, the standard required an IEEE 802.2 header to follow the length and specify the type. Many years later, the 802.3x-1997 standard, and later versions of the 802.3 standard, formally approved of both types of framing. Ethernet II framing is the most common in Ethernet local area networks, due to its simplicity and lower overhead.

In order to allow some frames using Ethernet II framing and some using the original version of 802.3 framing to be used on the same Ethernet segment, EtherType values must be greater than or equal to 1536 (0x0600). That value was chosen because the maximum length of the payload field of an Ethernet 802.3 frame is 1500 octets (0x05DC). Thus if the field's value is greater than or equal to 1536, the frame must be an Ethernet II frame, with that field being a type field.[9] If it's less than or equal to 1500, it must be an IEEE 802.3 frame, with that field being a length field. Values between 1500 and 1536, exclusive, are undefined.[10] This convention allows software to determine whether a frame is an Ethernet II frame or an IEEE 802.3 frame, allowing the coexistence of both standards on the same physical medium.

Novell raw IEEE 802.3[edit]

Novell's "raw" 802.3 frame format was based on early IEEE 802.3 work. Novell used this as a starting point to create the first implementation of its own IPX Network Protocol over Ethernet. They did not use any LLC header but started the IPX packet directly after the length field. This does not conform to the IEEE 802.3 standard, but since IPX always has FF as the first two octets (while in IEEE 802.2 LLC that pattern is theoretically possible but extremely unlikely), in practice this usually coexists on the wire with other Ethernet implementations, with the notable exception of some early forms of DECnet which got confused by this.

Novell NetWare used this frame type by default until the mid-nineties, and since NetWare was then very widespread, while IP was not, at some point in time most of the world's Ethernet traffic ran over "raw" 802.3 carrying IPX. Since NetWare 4.10, NetWare defaults to IEEE 802.2 with LLC (NetWare Frame Type Ethernet_802.2) when using IPX.[11]

IEEE 802.2 LLC[edit]

Main article: IEEE 802.2

Some protocols, such as those designed for the OSI stack, operate directly on top of IEEE 802.2 LLC encapsulation, which provides both connection-oriented and connectionless network services.

IEEE 802.2 LLC encapsulation is not in widespread use on common networks currently, with the exception of large corporate NetWare installations that have not yet migrated to NetWare over IP. In the past, many corporate networks used IEEE 802.2 to support transparent translating bridges between Ethernet and Token Ring or FDDI networks.

There exists an Internet standard for encapsulating IPv4 traffic in IEEE 802.2 LLC SAP/SNAP frames.[12] It is almost never implemented on Ethernet, although it is used on FDDI, Token Ring, IEEE 802.11 (with the exception of the 5.9 GHz band, where it uses EtherType)[13] and other IEEE 802 LANs. IPv6 can also be transmitted over Ethernet using IEEE 802.2 LLC SAP/SNAP, but, again, that's almost never used.

IEEE 802.2 SNAP[edit]

Main article: Subnetwork Access Protocol

By examining the 802.2 LLC header, it is possible to determine whether it is followed by a SNAP header. The LLC header includes two eight-bit address fields, called service access points (SAPs) in OSI terminology; when both source and destination SAP are set to the value 0xAA, the LLC header is followed by a SNAP header. The SNAP header allows EtherType values to be used with all IEEE 802 protocols, as well as supporting private protocol ID spaces.

In IEEE 802.3x-1997, the IEEE Ethernet standard was changed to explicitly allow the use of the 16-bit field after the MAC addresses to be used as a length field or a type field.

The AppleTalk v2 protocol suite on Ethernet ("EtherTalk") uses IEEE 802.2 LLC + SNAP encapsulation.

Maximum throughput[edit]

We may calculate the protocol overhead for Ethernet as a percentage (packet size including IPG)

Protocol overhead

=

Packet size

−

Payload size

Packet size

{\displaystyle {\text{Protocol overhead}}={\frac {{\text{Packet size}}-{\text{Payload size}}}{\text{Packet size}}}}

We may calculate the protocol efficiency for Ethernet

Protocol efficiency

=

Payload size

Packet size

{\displaystyle {\text{Protocol efficiency}}={\frac {\text{Payload size}}{\text{Packet size}}}}

Maximum efficiency is achieved with largest allowed payload size and is:

1500

1538

=

97.53

%

{\displaystyle {\frac {1500}{1538}}=97.53\%}

for untagged frames, since the packet size is maximum 1500 octet payload + 8 octet preamble + 14 octet header + 4 octet trailer + minimum interpacket gap corresponding to 12 octets = 1538 octets. The maximum efficiency is:

1500

1542

=

97.28

%

{\displaystyle {\frac {1500}{1542}}=97.28\%}

when 802.1Q VLAN tagging is used.

The throughput may be calculated from the efficiency

Throughput

=

Efficiency

×

Net bit rate

{\displaystyle {\text{Throughput}}={\text{Efficiency}}\times {\text{Net bit rate}}\,\!}

,

where the physical layer net bit rate (the wire bit rate) depends on the Ethernet physical layer standard, and may be 10 Mbit/s, 100 Mbit/s, 1 Gbit/s or 10 Gbit/s. Maximum throughput for 100BASE-TX Ethernet is consequently 97.53 Mbit/s without 802.1Q, and 97.28 Mbit/s with 802.1Q.

Channel utilization is a concept often confused with protocol efficiency. It considers only the use of the channel disregarding the nature of the data transmitted – either payload or overhead. At the physical layer, the link channel and equipment do not know the difference between data and control frames. We may calculate the channel utilization:

Channel utilization

=

Time spent transmitting data

Total time

{\displaystyle {\text{Channel utilization}}={\frac {\text{Time spent transmitting data}}{\text{Total time}}}}

The total time considers the round trip time along the channel, the processing time in the hosts and the time transmitting data and acknowledgements. The time spent transmitting data includes data and acknowledgements.

Runt frames[edit]

A runt frame is an Ethernet frame that is less than the IEEE 802.3's minimum length of 64 octets. Runt frames are most commonly caused by collisions; other possible causes are a malfunctioning network card, buffer underrun, duplex mismatch or software issues.[14]

Notes[edit]

^ The frame check sequence (FCS) uses a different bit ordering.[3]

^ The bit patterns in the preamble and start of frame delimiter are written as bit strings, with the first bit transmitted on the left (not as octet values, which in Ethernet are transmitted least significant bit(s) first). This notation matches the one used in the IEEE 802.3 standard.

^ Payload can be 42 octets if an 802.1Q tag is present. Minimum is 46 octets without.

^ Preamble and start frame delimiter are not displayed by packet sniffing software because these bits are stripped away at OSI layer 1 by the network interface controller (NIC) before being passed on to the OSI layer 2, which is where packet sniffers collect their data. There are layer-2 sniffers that can capture and display the preamble and start frame delimiter, but they are expensive and mainly used to detect problems related to physical connectivity.

^ Minimum payload size is dictated by the 512-bit slot time used for collision detection in the Ethernet LAN architecture.

^ Both 42 and 46 octet minimums are valid when 802.1Q is present.[4]

^ A version 1 Ethernet frame was used for early Ethernet prototypes and featured 8-bit MAC addresses and was never commercially deployed.

^ Original Ethernet frames define their length with the framing that surrounds it, rather than with an explicit length count.

References[edit]

^ a b c d e 802.3-2018 – IEEE Standard for Ethernet. IEEE. 14 June 2018. doi:10.1109/IEEESTD.2018.8457469. ISBN 978-1-5044-5090-4.

^ a b "3.1.1 Packet format". 802.3-2018 – IEEE Standard for Ethernet. IEEE. 14 June 2018. doi:10.1109/IEEESTD.2018.8457469. ISBN 978-1-5044-5090-4.

^ 802.3-2018 – IEEE Standard for Ethernet. IEEE. 14 June 2018. Section 3.3 and annex 31A. doi:10.1109/IEEESTD.2018.8457469. ISBN 978-1-5044-5090-4. Opcodes are transmitted high-order octet first. Within each octet, bits are transmitted least-significant bit first. [...] Each octet of the MAC frame, with the exception of the FCS, is transmitted least significant bit first.

^ "Annex G". IEEE Standard for Local and metropolitan area networks--Media Access Control (MAC) Bridges and Virtual Bridged Local Area Networks. doi:10.1109/IEEESTD.2011.6009146. ISBN 978-0-7381-6708-4.

^ "Specification of CRC Routines V4.5.0 R4.1 Rev 3" (PDF). AUTOSAR. p. 24.

^ Charles E. Spurgeon (February 2000). Ethernet: The Definitive Guide. O'Reilly. pp. 41, 47. ISBN 9780596552824. Retrieved 30 June 2014.

^ "40.1.3.1 Physical Coding Sublayer (PCS)". 802.3-2018 – IEEE Standard for Ethernet. IEEE. 14 June 2018. doi:10.1109/IEEESTD.2018.8457469. ISBN 978-1-5044-5090-4.

^ Drew Heywood; Zubair Ahmad (2001). Drew Heywood's Windows 2000 Network Services. Sams. p. 53. ISBN 978-0-672-31741-5.

^ LAN MAN Standards Committee of the IEEE Computer Society (20 March 1997). IEEE Std 802.3x-1997 and IEEE Std 802.3y-1997. The Institute of Electrical and Electronics Engineers, Inc. pp. 28–31.

^ "3.2.6 Length/Type field". 802.3-2018 – IEEE Standard for Ethernet. 14 June 2018. doi:10.1109/IEEESTD.2018.8457469. ISBN 978-1-5044-5090-4.

^ Don Provan (17 September 1993). "Ethernet Framing". Newsgroup: comp.sys.novell. Usenet: 1993Sep17.190654.13335@novell.com. (HTML-formatted version Archived 18 April 2015 at the Wayback Machine)  — a classic series of Usenet postings by Novell's Don Provan that have found their way into numerous FAQs and are widely considered the definitive answer to the Novell Frame Type usage.

^

A Standard for the Transmission of IP Datagrams over IEEE 802 Networks. Network Working Group of the IETF. February 1988. doi:10.17487/RFC1042. RFC 1042.

^ Computer Society, IEEE (2016). IEEE Std 802.11-2016: Part 11: Wireless LAN Medium Access Control IEEE (MAC) and Physical Layer (PHY) Specifications. New York, NY: IEEE. p. 249.

^

"Troubleshooting Ethernet". Cisco Systems. Retrieved 13 August 2016.

Further reading[edit]

Wikiversity has learning resources about Topic:Web Science/Part1: Foundations of the web/Internet Architecture/Ethernet

Video which explains how to build an Ethernet Frame

Minimum Frame Length in Ethernet explained

vteEthernet family of local area network technologiesSpeeds

10 Mbit/s

100 Mbit/s

1 Gbit/s

2.5 and 5 Gbit/s

10 Gbit/s

25 and 50 Gbit/s

40 and 100 Gbit/s

200, 400, 800 and 1600 Gbit/s

General

Physical layer

Autonegotiation

EtherType

Flow control

Frames

Jumbos

Organizations

IEEE 802.3

Ethernet Alliance

Media

Twisted pair

Coaxial

First mile

10G-EPON

Historic

CSMA/CD

StarLAN

10BROAD36

10BASE-FB

10BASE-FL

10BASE5

10BASE2

MAU

FOIRL

100BaseVG

LattisNet

Long Reach

Applications

Audio

Carrier

Data center

Energy Efficiency

Industrial

Metro

Power

Synchronous

Transceivers

GBIC

SFP/SFP+/QSFP/QSFP+/OSFP

XENPAK/X2

XFP

CFP

Interfaces

AUI

EAD

MDI

MII

GMII

XGMII

XAUI

Category

Commons

Retrieved from "https://en.wikipedia.org/w/index.php?title=Ethernet_frame&oldid=1211981089"

Category: EthernetHidden categories: Webarchive template wayback linksArticles with short descriptionShort description is different from WikidataUse dmy dates from March 2024Use American English from March 2019All Wikipedia articles written in American EnglishArticles containing video clips

This page was last edited on 5 March 2024, at 15:40 (UTC).

Text is available under the Creative Commons Attribution-ShareAlike License 4.0;

additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.

Privacy policy

About Wikipedia

Disclaimers

Contact Wikipedia

Code of Conduct

Developers

Statistics

Cookie statement

Mobile view

Toggle limited content width

Ethernet frame - Wikipedia

Ethernet frame - Wikipedia

Jump to content

Main menu

Main menu

move to sidebar

hide

Navigation

Main pageContentsCurrent eventsRandom articleAbout WikipediaContact usDonate

Contribute

HelpLearn to editCommunity portalRecent changesUpload file

Search

Search

Create account

Log in

Personal tools

Create account Log in

Pages for logged out editors learn more

ContributionsTalk

Contents

move to sidebar

hide

(Top)

1Structure

Toggle Structure subsection

1.1Ethernet packet – physical layer

1.1.1Preamble and start frame delimiter

1.2Frame – data link layer

1.2.1Header

1.2.2Payload

1.2.3Frame check sequence

1.3End of frame – physical layer

1.4Interpacket gap – physical layer

2Types

Toggle Types subsection

2.1Ethernet II

2.2Novell raw IEEE 802.3

2.3IEEE 802.2 LLC

2.4IEEE 802.2 SNAP

3Maximum throughput

4Runt frames

5Notes

6References

7Further reading

Toggle the table of contents

Ethernet frame

12 languages

CatalàČeštinaDeutschEspañol한국어Bahasa IndonesiaItaliano日本語SvenskaTürkçeTiếng Việt中文

Edit links

ArticleTalk

English

ReadEditView history

Tools

Tools

move to sidebar

hide

Actions

ReadEditView history

General

What links hereRelated changesUpload fileSpecial pagesPermanent linkPage informationCite this pageGet shortened URLDownload QR codeWikidata item

Print/export

Download as PDFPrintable version

From Wikipedia, the free encyclopedia

Unit of data on an Ethernet network

Ethernet packet. The SFD (start frame delimiter) marks the end of the packet preamble. It is immediately followed by the Ethernet frame, which starts with the destination MAC address.[1]

In computer networking, an Ethernet frame is a data link layer protocol data unit and uses the underlying Ethernet physical layer transport mechanisms. In other words, a data unit on an Ethernet link transports an Ethernet frame as its payload.[2]

An Ethernet frame is preceded by a preamble and start frame delimiter (SFD), which are both part of the Ethernet packet at the physical layer. Each Ethernet frame starts with an Ethernet header, which contains destination and source MAC addresses as its first two fields. The middle section of the frame is payload data including any headers for other protocols (for example, Internet Protocol) carried in the frame. The frame ends with a frame check sequence (FCS), which is a 32-bit cyclic redundancy check used to detect any in-transit corruption of data.

Structure[edit]

See also: Physical Coding Sublayer

A data packet on the wire and the frame as its payload consist of binary data. Ethernet transmits data with the most-significant octet (byte) first; within each octet, however, the least-significant bit is transmitted first.[a]

The internal structure of an Ethernet frame is specified in IEEE 802.3.[2] The table below shows the complete Ethernet packet and the frame inside, as transmitted, for the payload size up to the MTU of 1500 octets.[b] Some implementations of Gigabit Ethernet and other higher-speed variants of Ethernet support larger frames, known as jumbo frames.

802.3 Ethernet packet and frame structure

Layer

Preamble

Start frame delimiter (SFD)

MAC destination

MAC source

802.1Q tag (optional)

Ethertype (Ethernet II) or length (IEEE 802.3)

Payload

Frame check sequence (32‑bit CRC)

Interpacket gap (IPG)

Length (octets)

7

1

6

6

(4)

2

42–1500[c]

4

12

Layer 2 Ethernet frame

(not part of the frame)

← 64–1522 octets →

(not part of the frame)

Layer 1 Ethernet packet & IPG

← 72–1530 octets →

← 12 octets →

The optional 802.1Q tag consumes additional space in the frame. Field sizes for this option are shown in brackets in the table above. IEEE 802.1ad (Q-in-Q) allows for multiple tags in each frame. This option is not illustrated here.

Ethernet packet – physical layer[edit]

Preamble and start frame delimiter[edit]

See also: Syncword

An Ethernet packet starts with a seven-octet (56-bit) preamble and one-octet (8-bit) start frame delimiter (SFD).[d] The preamble bit values alternate 1 and 0, allowing receivers to synchronize their clock at the bit-level with the transmitter. The preamble is followed by the SFD which ends with a 1 instead of 0, to break the bit pattern of the preamble and signal the start of the actual frame.[1]: section 4.2.5 

Physical layer transceiver circuitry (PHY for short) is required to connect the Ethernet MAC to the physical medium. The connection between a PHY and MAC is independent of the physical medium and uses a bus from the media independent interface family (MII, GMII, RGMII, SGMII, XGMII). The preamble and SFD representation depends on the width of the bus:

Preamble and SFD representations as bits, decimal, bytes, and nibbles

Representation

56-bit (7-byte) Preamble

SFD byte

uncoded on-the-wire bit pattern transmitted from left to right (used by Ethernet variants transmitting serial bits instead of larger symbols)[1]: sections 4.2.5 and 3.2.2 

10101010

10101010

10101010

10101010

10101010

10101010

10101010

10101011

decimal in Ethernet LSb-first ordering[1]: sections 3.2.2, 3.3 and 4.2.6 

85

85

85

85

85

85

85

213

hexadecimal LSb-first bytes for 8-bit wide busses

(GMII bus for Gigabit Ethernet transceivers)

0x55

0x55

0x55

0x55

0x55

0x55

0x55

0xD5

hexadecimal LSb-first nibbles for 4-bit wide busses (MII bus for Fast Ethernet or RGMII for gigabit transceivers)

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0x5

0xD

The SFD is immediately followed by the destination MAC address, which is the first field in an Ethernet frame.

Frame – data link layer[edit]

Header[edit]

The header features destination and source MAC addresses (each six octets in length), the EtherType field and, optionally, an IEEE 802.1Q tag or IEEE 802.1ad tag.

The EtherType field is two octets long and it can be used for two different purposes. Values of 1500 and below mean that it is used to indicate the size of the payload in octets, while values of 1536 and above indicate that it is used as an EtherType, to indicate which protocol is encapsulated in the payload of the frame. When used as EtherType, the length of the frame is determined by the location of the interpacket gap and valid frame check sequence (FCS).

The IEEE 802.1Q tag or IEEE 802.1ad tag, if present, is a four-octet field that indicates virtual LAN (VLAN) membership and IEEE 802.1p priority. The first two octets of the tag are called the Tag Protocol IDentifier (TPID) and double as the EtherType field indicating that the frame is either 802.1Q or 802.1ad tagged. 802.1Q uses a TPID of 0x8100. 802.1ad uses a TPID of 0x88a8.

Payload[edit]

Payload is a variable-length field. Its minimum size is governed by a requirement for a minimum frame transmission of 64 octets (bytes).[e] With header and FCS taken into account, the minimum payload is 42 octets when an 802.1Q tag is present[f] and 46 octets when absent. When the actual payload is less than the minimum, padding octets are added accordingly. IEEE standards specify a maximum payload of 1500 octets. Non-standard jumbo frames allow for larger payloads on networks built to support them.

Frame check sequence[edit]

The frame check sequence (FCS) is a four-octet cyclic redundancy check (CRC) that allows detection of corrupted data within the entire frame as received on the receiver side. According to the standard, the FCS value is computed as a function of the protected MAC frame fields: source and destination address, length/type field, MAC client data and padding (that is, all fields except the FCS).

Per the standard, this computation is done using the left shifting CRC-32 (polynomial = 0x4C11DB7, initial CRC = 0xFFFFFFFF, CRC is post complemented, verify value = 0x38FB2284) algorithm. The standard states that data is transmitted least significant bit (bit 0) first, while the FCS is transmitted most significant bit (bit 31) first.[1]: section 3.2.9  An alternative is to calculate a CRC using the right shifting CRC-32 (polynomial = 0xEDB88320, initial CRC = 0xFFFFFFFF, CRC is post complemented, verify value = 0x2144DF1C), which will result in a CRC that is a bit reversal of the FCS, and transmit both data and the CRC least significant bit first, resulting in identical transmissions.

The standard states that the receiver should calculate a new FCS as data is received and then compare the received FCS with the FCS the receiver has calculated. An alternative is to calculate a CRC on both the received data and the FCS, which will result in a fixed non-zero "verify" value. (The result is non-zero because the CRC is post complemented during CRC generation). Since the data is received least significant bit first, and to avoid having to buffer octets of data, the receiver typically uses the right shifting CRC-32. This makes the "verify" value (sometimes called "magic check") 0x2144DF1C.[5]

However, hardware implementation of a logically right shifting CRC may use a left shifting Linear Feedback Shift Register as the basis for calculating the CRC, reversing the bits and resulting in a verify value of 0x38FB2284. Since the complementing of the CRC may be performed post calculation and during transmission, what remains in the hardware register is a non-complemented result, so the residue for a right shifting implementation would be the complement of 0x2144DF1C = 0xDEBB20E3, and for a left shifting implementation, the complement of 0x38FB2284 = 0xC704DD7B.

End of frame – physical layer[edit]

The end of a frame is usually indicated by the end-of-data-stream symbol at the physical layer or by loss of the carrier signal; an example is 10BASE-T, where the receiving station detects the end of a transmitted frame by loss of the carrier. Later physical layers use an explicit end of data or end of stream symbol or sequence to avoid ambiguity, especially where the carrier is continually sent between frames; an example is Gigabit Ethernet with its 8b/10b encoding scheme that uses special symbols which are transmitted before and after a frame is transmitted.[6][7]

Interpacket gap – physical layer[edit]

Interpacket gap (IPG) is idle time between packets. After a packet has been sent, transmitters are required to transmit a minimum of 96 bits (12 octets) of idle line state before transmitting the next packet.

Types[edit]

Ethernet frame differentiation

Frame type

Ethertype or length

Payload start two bytes

Ethernet II

≥ 1536

Any

Novell raw IEEE 802.3

≤ 1500

0xFFFF

IEEE 802.2 LLC

≤ 1500

Other

IEEE 802.2 SNAP

≤ 1500

0xAAAA

There are several types of Ethernet frames:

Ethernet II frame, or Ethernet Version 2,[g] or DIX frame is the most common type in use today, as it is often used directly by the Internet Protocol.

Novell raw IEEE 802.3 non-standard variation frame

IEEE 802.2 Logical Link Control (LLC) frame

IEEE 802.2 Subnetwork Access Protocol (SNAP) frame

The different frame types have different formats and MTU values, but can coexist on the same physical medium. Differentiation between frame types is possible based on the table on the right.

In addition, all four Ethernet frame types may optionally contain an IEEE 802.1Q tag to identify what VLAN it belongs to and its priority (quality of service). This encapsulation is defined in the IEEE 802.3ac specification and increases the maximum frame by 4 octets.

The IEEE 802.1Q tag, if present, is placed between the Source Address and the EtherType or Length fields. The first two octets of the tag are the Tag Protocol Identifier (TPID) value of 0x8100. This is located in the same place as the EtherType/Length field in untagged frames, so an EtherType value of 0x8100 means the frame is tagged, and the true EtherType/Length is located after the Q-tag. The TPID is followed by two octets containing the Tag Control Information (TCI) (the IEEE 802.1p priority (quality of service) and VLAN id). The Q-tag is followed by the rest of the frame, using one of the types described above.

Ethernet II[edit]

Ethernet II framing (also known as DIX Ethernet, named after DEC, Intel and Xerox, the major participants in its design[8]), defines the two-octet EtherType field in an Ethernet frame, preceded by destination and source MAC addresses, that identifies an upper layer protocol encapsulated by the frame data. Most notably, an EtherType value of 0x0800 indicates that the frame contains an IPv4 datagram, 0x0806 indicates an ARP datagram, and 0x86DD indicates an IPv6 datagram. See EtherType § Values for more.

The most common Ethernet frame format, type II

As this industry-developed standard went through a formal IEEE standardization process, the EtherType field was changed to a (data) length field in the new 802.3 standard.[h] Since the recipient still needs to know how to interpret the frame, the standard required an IEEE 802.2 header to follow the length and specify the type. Many years later, the 802.3x-1997 standard, and later versions of the 802.3 standard, formally approved of both types of framing. Ethernet II framing is the most common in Ethernet local area networks, due to its simplicity and lower overhead.

In order to allow some frames using Ethernet II framing and some using the original version of 802.3 framing to be used on the same Ethernet segment, EtherType values must be greater than or equal to 1536 (0x0600). That value was chosen because the maximum length of the payload field of an Ethernet 802.3 frame is 1500 octets (0x05DC). Thus if the field's value is greater than or equal to 1536, the frame must be an Ethernet II frame, with that field being a type field.[9] If it's less than or equal to 1500, it must be an IEEE 802.3 frame, with that field being a length field. Values between 1500 and 1536, exclusive, are undefined.[10] This convention allows software to determine whether a frame is an Ethernet II frame or an IEEE 802.3 frame, allowing the coexistence of both standards on the same physical medium.

Novell raw IEEE 802.3[edit]

Novell's "raw" 802.3 frame format was based on early IEEE 802.3 work. Novell used this as a starting point to create the first implementation of its own IPX Network Protocol over Ethernet. They did not use any LLC header but started the IPX packet directly after the length field. This does not conform to the IEEE 802.3 standard, but since IPX always has FF as the first two octets (while in IEEE 802.2 LLC that pattern is theoretically possible but extremely unlikely), in practice this usually coexists on the wire with other Ethernet implementations, with the notable exception of some early forms of DECnet which got confused by this.

Novell NetWare used this frame type by default until the mid-nineties, and since NetWare was then very widespread, while IP was not, at some point in time most of the world's Ethernet traffic ran over "raw" 802.3 carrying IPX. Since NetWare 4.10, NetWare defaults to IEEE 802.2 with LLC (NetWare Frame Type Ethernet_802.2) when using IPX.[11]

IEEE 802.2 LLC[edit]

Main article: IEEE 802.2

Some protocols, such as those designed for the OSI stack, operate directly on top of IEEE 802.2 LLC encapsulation, which provides both connection-oriented and connectionless network services.

IEEE 802.2 LLC encapsulation is not in widespread use on common networks currently, with the exception of large corporate NetWare installations that have not yet migrated to NetWare over IP. In the past, many corporate networks used IEEE 802.2 to support transparent translating bridges between Ethernet and Token Ring or FDDI networks.

There exists an Internet standard for encapsulating IPv4 traffic in IEEE 802.2 LLC SAP/SNAP frames.[12] It is almost never implemented on Ethernet, although it is used on FDDI, Token Ring, IEEE 802.11 (with the exception of the 5.9 GHz band, where it uses EtherType)[13] and other IEEE 802 LANs. IPv6 can also be transmitted over Ethernet using IEEE 802.2 LLC SAP/SNAP, but, again, that's almost never used.

IEEE 802.2 SNAP[edit]

Main article: Subnetwork Access Protocol

By examining the 802.2 LLC header, it is possible to determine whether it is followed by a SNAP header. The LLC header includes two eight-bit address fields, called service access points (SAPs) in OSI terminology; when both source and destination SAP are set to the value 0xAA, the LLC header is followed by a SNAP header. The SNAP header allows EtherType values to be used with all IEEE 802 protocols, as well as supporting private protocol ID spaces.

In IEEE 802.3x-1997, the IEEE Ethernet standard was changed to explicitly allow the use of the 16-bit field after the MAC addresses to be used as a length field or a type field.

The AppleTalk v2 protocol suite on Ethernet ("EtherTalk") uses IEEE 802.2 LLC + SNAP encapsulation.

Maximum throughput[edit]

We may calculate the protocol overhead for Ethernet as a percentage (packet size including IPG)

Protocol overhead

=

Packet size

−

Payload size

Packet size

{\displaystyle {\text{Protocol overhead}}={\frac {{\text{Packet size}}-{\text{Payload size}}}{\text{Packet size}}}}

We may calculate the protocol efficiency for Ethernet

Protocol efficiency

=

Payload size

Packet size

{\displaystyle {\text{Protocol efficiency}}={\frac {\text{Payload size}}{\text{Packet size}}}}

Maximum efficiency is achieved with largest allowed payload size and is:

1500

1538

=

97.53

%

{\displaystyle {\frac {1500}{1538}}=97.53\%}

for untagged frames, since the packet size is maximum 1500 octet payload + 8 octet preamble + 14 octet header + 4 octet trailer + minimum interpacket gap corresponding to 12 octets = 1538 octets. The maximum efficiency is:

1500

1542

=

97.28

%

{\displaystyle {\frac {1500}{1542}}=97.28\%}

when 802.1Q VLAN tagging is used.

The throughput may be calculated from the efficiency

Throughput

=

Efficiency

×

Net bit rate

{\displaystyle {\text{Throughput}}={\text{Efficiency}}\times {\text{Net bit rate}}\,\!}

,

where the physical layer net bit rate (the wire bit rate) depends on the Ethernet physical layer standard, and may be 10 Mbit/s, 100 Mbit/s, 1 Gbit/s or 10 Gbit/s. Maximum throughput for 100BASE-TX Ethernet is consequently 97.53 Mbit/s without 802.1Q, and 97.28 Mbit/s with 802.1Q.

Channel utilization is a concept often confused with protocol efficiency. It considers only the use of the channel disregarding the nature of the data transmitted – either payload or overhead. At the physical layer, the link channel and equipment do not know the difference between data and control frames. We may calculate the channel utilization:

Channel utilization

=

Time spent transmitting data

Total time

{\displaystyle {\text{Channel utilization}}={\frac {\text{Time spent transmitting data}}{\text{Total time}}}}

The total time considers the round trip time along the channel, the processing time in the hosts and the time transmitting data and acknowledgements. The time spent transmitting data includes data and acknowledgements.

Runt frames[edit]

A runt frame is an Ethernet frame that is less than the IEEE 802.3's minimum length of 64 octets. Runt frames are most commonly caused by collisions; other possible causes are a malfunctioning network card, buffer underrun, duplex mismatch or software issues.[14]

Notes[edit]

^ The frame check sequence (FCS) uses a different bit ordering.[3]

^ The bit patterns in the preamble and start of frame delimiter are written as bit strings, with the first bit transmitted on the left (not as octet values, which in Ethernet are transmitted least significant bit(s) first). This notation matches the one used in the IEEE 802.3 standard.

^ Payload can be 42 octets if an 802.1Q tag is present. Minimum is 46 octets without.

^ Preamble and start frame delimiter are not displayed by packet sniffing software because these bits are stripped away at OSI layer 1 by the network interface controller (NIC) before being passed on to the OSI layer 2, which is where packet sniffers collect their data. There are layer-2 sniffers that can capture and display the preamble and start frame delimiter, but they are expensive and mainly used to detect problems related to physical connectivity.

^ Minimum payload size is dictated by the 512-bit slot time used for collision detection in the Ethernet LAN architecture.

^ Both 42 and 46 octet minimums are valid when 802.1Q is present.[4]

^ A version 1 Ethernet frame was used for early Ethernet prototypes and featured 8-bit MAC addresses and was never commercially deployed.

^ Original Ethernet frames define their length with the framing that surrounds it, rather than with an explicit length count.

References[edit]

^ a b c d e 802.3-2018 – IEEE Standard for Ethernet. IEEE. 14 June 2018. doi:10.1109/IEEESTD.2018.8457469. ISBN 978-1-5044-5090-4.

^ a b "3.1.1 Packet format". 802.3-2018 – IEEE Standard for Ethernet. IEEE. 14 June 2018. doi:10.1109/IEEESTD.2018.8457469. ISBN 978-1-5044-5090-4.

^ 802.3-2018 – IEEE Standard for Ethernet. IEEE. 14 June 2018. Section 3.3 and annex 31A. doi:10.1109/IEEESTD.2018.8457469. ISBN 978-1-5044-5090-4. Opcodes are transmitted high-order octet first. Within each octet, bits are transmitted least-significant bit first. [...] Each octet of the MAC frame, with the exception of the FCS, is transmitted least significant bit first.

^ "Annex G". IEEE Standard for Local and metropolitan area networks--Media Access Control (MAC) Bridges and Virtual Bridged Local Area Networks. doi:10.1109/IEEESTD.2011.6009146. ISBN 978-0-7381-6708-4.

^ "Specification of CRC Routines V4.5.0 R4.1 Rev 3" (PDF). AUTOSAR. p. 24.

^ Charles E. Spurgeon (February 2000). Ethernet: The Definitive Guide. O'Reilly. pp. 41, 47. ISBN 9780596552824. Retrieved 30 June 2014.

^ "40.1.3.1 Physical Coding Sublayer (PCS)". 802.3-2018 – IEEE Standard for Ethernet. IEEE. 14 June 2018. doi:10.1109/IEEESTD.2018.8457469. ISBN 978-1-5044-5090-4.

^ Drew Heywood; Zubair Ahmad (2001). Drew Heywood's Windows 2000 Network Services. Sams. p. 53. ISBN 978-0-672-31741-5.

^ LAN MAN Standards Committee of the IEEE Computer Society (20 March 1997). IEEE Std 802.3x-1997 and IEEE Std 802.3y-1997. The Institute of Electrical and Electronics Engineers, Inc. pp. 28–31.

^ "3.2.6 Length/Type field". 802.3-2018 – IEEE Standard for Ethernet. 14 June 2018. doi:10.1109/IEEESTD.2018.8457469. ISBN 978-1-5044-5090-4.

^ Don Provan (17 September 1993). "Ethernet Framing". Newsgroup: comp.sys.novell. Usenet: 1993Sep17.190654.13335@novell.com. (HTML-formatted version Archived 18 April 2015 at the Wayback Machine)  — a classic series of Usenet postings by Novell's Don Provan that have found their way into numerous FAQs and are widely considered the definitive answer to the Novell Frame Type usage.

^

A Standard for the Transmission of IP Datagrams over IEEE 802 Networks. Network Working Group of the IETF. February 1988. doi:10.17487/RFC1042. RFC 1042.

^ Computer Society, IEEE (2016). IEEE Std 802.11-2016: Part 11: Wireless LAN Medium Access Control IEEE (MAC) and Physical Layer (PHY) Specifications. New York, NY: IEEE. p. 249.

^

"Troubleshooting Ethernet". Cisco Systems. Retrieved 13 August 2016.

Further reading[edit]

Wikiversity has learning resources about Topic:Web Science/Part1: Foundations of the web/Internet Architecture/Ethernet

Video which explains how to build an Ethernet Frame

Minimum Frame Length in Ethernet explained

vteEthernet family of local area network technologiesSpeeds

10 Mbit/s

100 Mbit/s

1 Gbit/s

2.5 and 5 Gbit/s

10 Gbit/s

25 and 50 Gbit/s

40 and 100 Gbit/s

200, 400, 800 and 1600 Gbit/s

General

Physical layer

Autonegotiation

EtherType

Flow control

Frames

Jumbos

Organizations

IEEE 802.3

Ethernet Alliance

Media

Twisted pair

Coaxial

First mile

10G-EPON

Historic

CSMA/CD

StarLAN

10BROAD36

10BASE-FB

10BASE-FL

10BASE5

10BASE2

MAU

FOIRL

100BaseVG

LattisNet

Long Reach

Applications

Audio

Carrier

Data center

Energy Efficiency

Industrial

Metro

Power

Synchronous

Transceivers

GBIC

SFP/SFP+/QSFP/QSFP+/OSFP

XENPAK/X2

XFP

CFP

Interfaces

AUI

EAD

MDI

MII

GMII

XGMII

XAUI

Category

Commons

Retrieved from "https://en.wikipedia.org/w/index.php?title=Ethernet_frame&oldid=1211981089"

Category: EthernetHidden categories: Webarchive template wayback linksArticles with short descriptionShort description is different from WikidataUse dmy dates from March 2024Use American English from March 2019All Wikipedia articles written in American EnglishArticles containing video clips

This page was last edited on 5 March 2024, at 15:40 (UTC).

Text is available under the Creative Commons Attribution-ShareAlike License 4.0;

additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.

Privacy policy

About Wikipedia

Disclaimers

Contact Wikipedia

Code of Conduct

Developers

Statistics

Cookie statement

Mobile view

Toggle limited content width

以太网帧结构详解 - 知乎

以太网帧结构详解 - 知乎首发于网络协议详解切换模式写文章登录/注册以太网帧结构详解nwatch计算机的世界真是太精彩了！！！前言20世纪60年代以来，计算机网络得到了飞速发展。各大厂商和标准组织为了在数据通信网络领域占据主导地位，纷纷推出了各自的网络架构体系和标准，如IBM公司的SNA协议，Novell公司的IPX/SPX协议，以及广泛流行的OSI参考模型和TCP/IP协议。同时，各大厂商根据这些协议生产出了不同的硬件和软件。标准组织和厂商的共同努力促进了网络技术的快速发展和网络设备种类的迅速增长。网络通信中，“协议”和“标准”这两个词汇常常可以混用。同时，协议或标准本身又常常具有层次的特点。一般地，关注于逻辑数据关系的协议通常被称为上层协议，而关注于物理数据流的协议通常被称为低层协议。IEEE 802就是一套用来管理物理数据流在局域网中传输的标准，包括在局域网中传输物理数据的802.3以太网标准。还有一些用来管理物理数据流在使用串行介质的广域网中传输的标准，如帧中继FR（Frame Relay），高级数据链路控制HDLC（High-Level Data Link Control），异步传输模式ATM（Asynchronous Transfer Mode）。分层模型- OSI不同的协议栈用于定义和管理不同网络的数据转发规则。国际标准化组织ISO于1984年提出了OSI RM（Open System Interconnection Reference Model，开放系统互连参考模型）。OSI 参考模型很快成为了计算机网络通信的基础模型。OSI参考模型具有以下优点：简化了相关的网络操作；提供了不同厂商之间的兼容性；促进了标准化工作；结构上进行了分层；易于学习和操作。OSI参考模型各个层次的基本功能如下：1.物理层: 在设备之间传输比特流，规定了电平、速度和电缆针脚。2.数据链路层：将比特组合成字节，再将字节组合成帧，使用链路层地址（以太网使用MAC地址）来访问介质，并进行差错检测。3.网络层：提供逻辑地址，供路由器确定路径。4.传输层：提供面向连接或非面向连接的数据传递以及进行重传前的差错检测。5.会话层：负责建立、管理和终止表示层实体之间的通信会话。该层的通信由不同设备中的应用程序之间的服务请求和响应组成。6.表示层：提供各种用于应用层数据的编码和转换功能，确保一个系统的应用层发送的数据能被另一个系统的应用层识别。7.应用层：OSI参考模型中最靠近用户的一层，为应用程序提供网络服务。分层模型– TCP/IPTCP/IP模型同样采用了分层结构，层与层相对独立但是相互之间也具备非常密切的协作关系。TCP/IP模型将网络分为四层。TCP/IP模型不关注底层物理介质，主要关注终端之间的逻辑数据流转发。TCP/IP模型的核心是网络层和传输层：网络层解决网络之间的逻辑转发问题，传输层保证源端到目的端之间的可靠传输。最上层的应用层通过各种协议向终端用户提供业务应用。数据封装应用数据需要经过TCP/IP每一层处理之后才能通过网络传输到目的端，每一层上都使用该层的协议数据单元PDU（Protocol Data Unit）彼此交换信息。不同层的PDU中包含有不同的信息，因此PDU在不同层被赋予了不同的名称。如上层数据在传输层添加TCP报头后得到的PDU被称为Segment（数据段 ）数据段被传递给网络层，网络层添加IP报头得到的PDU被称为Packet（数据包）数据包被传递到数据链路层，封装数据链路层报头得到的PDU被称为Frame（数据帧）最后，帧被转换为比特(物理层)通过网络介质传输。这种协议栈逐层向下传递数据，并添加报头和报尾的过程称为封装。终端之间的通信数据链路层控制数据帧在物理链路上传输。数据包在以太网物理介质上传播之前必须封装头部和尾部信息。封装后的数据包称为称为数据帧，数据帧中封装的信息决定了数据如何传输。以太网上传输的数据帧有两种格式，选择哪种格式由TCP/IP协议簇中的网络层决定。帧格式以太网上使用两种标准帧格式。第一种是上世纪80年代初提出的DIX v2格式，即Ethernet II帧格式。Ethernet II后来被IEEE 802标准接纳，并写进了IEEE 802.3x-1997的3.2.6节。第二种是1983年提出的IEEE 802.3格式。这两种格式的主要区别在于，Ethernet II格式中包含一个Type字段，标识以太帧处理完成之后将被发送到哪个上层协议进行处理。IEEE 802.3格式中，同样的位置是长度字段。不同的Type字段值可以用来区别这两种帧的类型当Type字段值小于等于1500（或者十六进制的0x05DC）时，帧使用的是IEEE 802.3格式。当Type字段值大于等于1536 （或者十六进制的0x0600）时，帧使用的是Ethernet II格式。以太网中大多数的数据帧使用的是Ethernet II格式。以太帧中还包括源和目的MAC地址，分别代表发送者的MAC和接收者的MAC，此外还有帧校验序列字段，用于检验传输过程中帧的完整性。Ethernet_II 帧格式Ethernet_II 帧类型值大于等于1536 (0x0600)以太网数据帧的长度在64-1518字节之间Ethernet_II的帧中各字段说明如下：DMAC（Destination MAC）是目的MAC地址。DMAC字段长度为6个字节，标识帧的接收者。SMAC（Source MAC）是源MAC地址。SMAC字段长度为6个字节，标识帧的发送者。类型字段（Type）用于标识数据字段中包含的高层协议，该字段长度为2个字节。类型字段取值为0x0800的帧代表IP协议帧；类型字段取值为0806的帧代表ARP协议帧。数据字段(Data)是网络层数据，最小长度必须为46字节以保证帧长至少为64字节，数据字段的最大长度为1500字节。循环冗余校验字段（FCS）提供了一种错误检测机制。该字段长度为4个字节。IEEE802.3 帧格式IEEE 802.3 帧长度字段值小于等于1500 (0x05DC)IEEE 802.3帧格式类似于Ethernet_II帧，只是Ethernet_II帧的Type域被802.3帧的Length域取代，并且占用了Data字段的8个字节作为LLC和SNAP字段。Length字段定义了Data字段包含的字节数。逻辑链路控制LLC（Logical Link Control）由目的服务访问点DSAP（Destination Service Access Point）、源服务访问点SSAP（Source Service Access Point）和Control字段组成。SNAP（Sub-network Access Protocol）由机构代码（Org Code）和类型（Type）字段组成。Org code三个字节都为0。Type字段的含义与Ethernet_II帧中的Type字段相同。IEEE802.3帧根据DSAP和SSAP字段的取值又可分为以下几类：当DSAP和SSAP都取特定值0xff时，802.3帧就变成了Netware-ETHERNET帧，用来承载NetWare类型的数据。当DSAP和SSAP都取特定值0xaa时，802.3帧就变成了ETHERNET_SNAP帧。ETHERNET_SNAP帧可以用于传输多种协议。DSAP和SSAP其他的取值均为纯IEEE802.3帧。数据帧传输数据链路层基于MAC地址进行帧的传输以太网在二层链路上通过MAC地址来唯一标识网络设备，并且实现局域网上网络设备之间的通信。MAC地址也叫物理地址，大多数网卡厂商把MAC地址烧入了网卡的ROM中。发送端使用接收端的MAC地址作为目的地址。以太帧封装完成后会通过物理层转换成比特流在物理介质上传输。以太网的MAC地址MAC地址由两部分组成，分别是供应商代码和序列号。其中前24位代表该供应商代码，由IEEE管理和分配。剩下的24位序列号由厂商自己分配。如同每一个人都有一个名字一样，每一台网络设备都用物理地址来标识自己，这个地址就是MAC地址。网络设备的MAC地址是全球唯一的。MAC地址长度为48比特，通常用十六进制表示。MAC地址包含两部分：前24比特是组织唯一标识符（OUI，Organizationally Unique Identifier），由IEEE统一分配给设备制造商。例如，华为的网络产品的MAC地址前24比特是0x00e0fc。后24位序列号是厂商分配给每个产品的唯一数值，由各个厂商自行分配（这里所说的产品可以是网卡或者其他需要MAC地址的设备）。数据帧的发送和接收单播局域网上的帧可以通过三种方式发送。第一种是单播，指从单一的源端发送到单一的目的端。每个主机接口由一个MAC地址唯一标识，MAC地址的OUI中，第一字节第8个比特表示地址类型。对于主机MAC地址，这个比特固定为0，表示目的MAC地址为此MAC地址的帧都是发送到某个唯一的目的端。在冲突域中，所有主机都能收到源主机发送的单播帧，但是其他主机发现目的地址与本地MAC地址不一致后会丢弃收到的帧，只有真正的目的主机才会接收并处理收到的帧。广播第二种发送方式是广播，表示帧从单一的源发送到共享以太网上的所有主机。广播帧的目的MAC地址为十六进制的FF:FF:FF:FF:FF:FF，所有收到该广播帧的主机都要接收并处理这个帧。广播方式会产生大量流量，导致带宽利用率降低，进而影响整个网络的性能。当需要网络中的所有主机都能接收到相同的信息并进行处理的情况下，通常会使用广播方式。组播第三种发送方式为组播，组播比广播更加高效。组播转发可以理解为选择性的广播，主机侦听特定组播地址，接收并处理目的MAC地址为该组播MAC地址的帧。组播MAC地址和单播MAC地址是通过第一字节中的第8个比特区分的。组播MAC地址的第8个比特为1，而单播MAC地址的第8个比特为0。当需要网络上的一组主机（而不是全部主机）接收相同信息，并且其他主机不受影响的情况下，通常会使用组播方式。发送与接收当主机接收到的数据帧所包含的目的MAC地址是自己时，会把以太网封装剥掉后送往上层协议。帧从主机的物理接口发送出来后，通过传输介质传输到目的端。共享网络中，这个帧可能到达多个主机。主机检查帧头中的目的MAC地址，如果目的MAC地址不是本机MAC地址，也不是本机侦听的组播或广播MAC地址，则主机会丢弃收到的帧。如果目的MAC地址是本机MAC地址，则接收该帧，检查帧校验序列（FCS）字段，并与本机计算的值对比来确定帧在传输过程中是否保持了完整性。如果帧的FCS值与本机计算的值不同，主机会认为帧已被破坏，并会丢弃该帧。如果该帧通过了FCS校验，则主机会根据帧头部中的Type字段来确定将帧发送给上层哪个协议处理。实际数据包分析：ARP类型数据包其他类型数据包：原文链接；以太网帧结构详解_曌赟的博客-CSDN博客发布于 2020-10-12 11:16计算机网络网络通信数据通信​赞同 53​​1 条评论​分享​喜欢​收藏​申请转载​文章被以下专栏收录网络协议详解网络协

ETHERNET数据包格式( IP & UDP & ICMP & ARP ) - the_tops - 博客园

ETHERNET数据包格式( IP & UDP & ICMP & ARP ) - the_tops - 博客园

会员

周边

新闻

博问

AI培训

云市场

所有博客

当前博客

我的博客

我的园子

账号设置

简洁模式 ...

退出登录

注册

登录

the_tops ----->人生犹如负重致远,不可急于求成.

在linux的浪潮中挣扎求存，转载，粘贴一切有用的好的文章，若有冒犯，请谅解.

博客园

首页

新随笔

联系

订阅

管理

ETHERNET数据包格式( IP & UDP & ICMP & ARP )

ETHERNET数据包格式( IP & UDP & ICMP & ARP )

ETHERNET数据包格式

一、ETHERNET 数据包的协议类型 TYPE 的值为 0x0800：IP协议，即：ETHERTYPE_IP，    该值在 /usr/include/net/ethernet.h中有定义。ETHERNET 数据包的格式又细分    为如下几种情况：(1) IP 报头中的协议号码为 IPPROTO_TCP，其值为 6 。ETHERNET 数据包的格式如下：    |<------------ Ethernet Header ---------->|    -------------------------------------------------------------------------    |DST MAC ADDR |SRC MAC ADDR |    TYPE     |   IP PACKET  |  TCP PACKET  |    -------------------------------------------------------------------------    |<- 6 bytes ->|<- 6 bytes ->|<- 2 bytes ->|<- 20 bytes ->|<- 20 bytes ->|    如下例所示：    00 00 21 cd a8 48 00 0a 98 1f 0a 8a 08 00 45 00    -- -- -- -- -- -- -- -- -- -- -- -- -- --    00 28 38 13 40 00 7e 06 85 48 a6 6f e5 87 a6 6f                         --       -- -- -- -- -- --    e5 0d 04 3a 01 95 bc 5d 5a 8b 25 69 20 82 50 11    -- -- -- -- -- --    41 87 cc 34 00 00 00 00 00 00 00 00 00 00 00 00    -- --    其中作如下说明：    00 00 --- 08 00         : ETHERNET PACKET，共 14 个字节          00 00 21 cd a8 48 : 接收方的 MAC 地址，6 个字节          00 0a 98 1f 0a 8a : 发送方的 MAC 地址，6 个字节          08 00             : 协议类型，2 个字节，                              0x0800：IP协议，该值在/usr/include/net/ethernet.h                                              中有定义，其值为：ETHERTYPE_IP    45 00 --- e5 0d         : IP PACKET ，共 20 个字节          06                : 协议类型，1 是 ICMP，6 是 TCP，17 是 UDP          a6 6f e5 87       : 发送方 IP 地址，4 个字节，十进制：166.111.229.135          a6 6f e5 0d       : 接收方 IP 地址，4 个字节，十进制：166.111.229.13    04 3a --- 00 00         : TCP PACKET，共 20 个字节          04 3a             : 发送方的端口号，2 个字节，其十进制表示为：1082          01 95             : 接收方的端口号，2 个字节，其十进制表示为：405          41 87             : TCP PACKET 的窗口大小(2) IP 报头中的协议号码为 IPPROTO_UDP，其值为 17 。ETHERNET 数据包的格式如下：    |<------------ Ethernet Header ---------->|    ------------------------------------------------------------------------    |DST MAC ADDR |SRC MAC ADDR |    TYPE     |   IP PACKET  | UDP PACKET  |    ------------------------------------------------------------------------    |<- 6 bytes ->|<- 6 bytes ->|<- 2 bytes ->|<- 20 bytes ->|<- 8 bytes ->|    如下例所示：    ff ff ff ff ff ff 00 80 c8 f7 0b 99 08 00 45 00    -- -- -- -- -- -- -- -- -- -- -- -- -- --    00 4e 0b 46 00 00 80 11 24 ff c0 a8 44 0a c0 a8                         --    44 ff 00 89 00 89 00 3a fa 63 80 37 01 10 00 01          -- -- -- -- -- -- -- --    00 00 00 00 00 00 20 45 4e 46 44 45 49 45 50 45    4e 45 46 43 41 43 41 43 41 43 41 43 41 43 41 43    41 43 41 43 41 42 4c 00 00 20 00 01    其中作如下说明：    ETHERNET PACKET、IP PACKET 的报头格式同 (1) ，                        其中：第二行的 11 表示 IPPROTO_UDP 协议。    00 89 --- fa 63         : UDP PACKET，共 8 个字节          00 89             : 发送方的端口号，2 个字节，其十进制表示为：137          00 89             : 接收方的端口号，2 个字节，其十进制表示为：137          00 3a             : UDP 包长度，其十进制表示为：58          fa 63             : UDP 检查和(3) IP 报头中的协议号码为 IPPROTO_ICMP，其值为 1 。ETHERNET数据包的格式如下：    |<------------ Ethernet Header ---------->|    -------------------------------------------------------------------------    |DST MAC ADDR |SRC MAC ADDR |    TYPE     |   IP PACKET  | ICMP PACKET |    -------------------------------------------------------------------------    |<- 6 bytes ->|<- 6 bytes ->|<- 2 bytes ->|<- 20 bytes ->|<- 8 bytes ->|    如下例所示：    00 0a 98 1f 0a 8a 00 00 21 cd a8 48 08 00 45 00    00 54 00 00 40 00 40 01 d0 97 a6 6f f9 0d ca 70                         --    00 24 08 00 bc 04 1b 21 00 01 c3 e6 2b 41 3b ae          -- -- -- -- -- -- -- --    0b 00 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15    16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25    26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35    36 37    其中作如下说明：    ETHERNET PACKET、IP PACKET 的报头格式同 (1) ，                        其中：第二行的 01 表示 IPPROTO_ICMP 协议。    08 00 --- 00 01         : ICMP PACKET，共 8 个字节          08                : ICMP_TYPE，1 个字节。          00                : ICMP_CODE，1 个字节。          bc 04             : ICMP 检查和          1b 21             : ICMP 标识          00 01             : ICMP 数据包序列号二、ETHERNET 数据包的协议类型 TYPE 的值为 0x0806：ARP协议，即：ETHERTYPE_ARP，    该值在 /usr/include/net/ethernet.h中有定义。ETHERNET 数据包的格式如下：    |<------------ Ethernet Header ---------->|    ------------------------------------------------------------    |DST MAC ADDR |SRC MAC ADDR |    TYPE     | ARP 协议数据包 |    ------------------------------------------------------------    |<- 6 bytes ->|<- 6 bytes ->|<- 2 bytes ->|<-- 28 bytes -->|    如下例所示：    ff ff ff ff ff ff 00 0a 98 1f 0a 8a 08 06 00 01    -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --    08 00 06 04 00 01 00 0a 98 1f 0a 8a a6 6f e5 01    -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --    00 00 00 00 00 00 a6 6f e5 58 00 00 00 00 00 00    -- -- -- -- -- -- -- -- -- --    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    其中作如下说明：    ff ff --- 08 06         : ETHERNET PACKET，共 14 个字节          ff ff ff ff ff ff : 接收方的 MAC 地址，6 个字节          00 0a 98 1f 0a 8a : 发送方的 MAC 地址，6 个字节          08 06             : 协议类型，2 个字节，                              0x0806：ARP协议，在/usr/include/net/ethernet.h                                             中有定义，其值为：ETHERTYPE_ARP    00 01 --- f9 58         : ARP PACKET ，共 28 个字节          00 01             : 硬件地址格式，2 个字节          08 00             : 协议地址格式，2 个字节          06                : 硬件地址长度，1 个字节          04                : 协议地址长度，1 个字节          00 01             : 可选项，2 个字节，0x0001：ARPOP_REQUEST，                                              0x0002：ARPOP_REPLY                              该值在 /usr/include/net/if_arp.h中有定义          00 0a 98 1f 0a 8a : 发送方的 MAC 地址，6 个字节          a6 6f e5 01       : 发送方的 IP 地址， 4 个字节，十进制：166.111.229.1          00 00 00 00 00 00 : 接收方的 MAC 地址，6 个字节          a6 6f e5 58       : 接收方的 IP 地址， 4 个字节，十进制：166.111.229.88

 

---------------------------------->人生犹如负重致远，不可急于求成。

自律使人自由！

posted @

2016-07-15 17:09 

the_tops 

阅读(3141) 

评论(0) 

编辑 

收藏 

举报

会员力量，点亮园子希望

刷新页面返回顶部

公告

Copyright © 2024 the_tops

Powered by .NET 8.0 on Kubernetes

Ethernet Frame Format - GeeksforGeeks

Ethernet Frame Format - GeeksforGeeks

Skip to content

TutorialsPython TutorialTaking Input in PythonPython OperatorsPython Data TypesPython NumbersPython StringPython ListsPython TuplesSets in PythonPython DictionaryPython Loops and Control FlowPython If ElsePython For LoopsPython While LoopsPython BreaksPython Continue StatementPython Pass StatementPython FunctionsPython OOPS ConceptPython Data StructuresPython DSALinked ListStackQueueTreeHeapHashingGraphSetsMapAdvance Data StructureSorting AlgorithmsSearching AlgorithmsPython Exception HandlingPython File HandlingPython ExercisesPython List ExercisePython String ExercisePython Tuple ExercisePython Dictionary ExercisePython Set ExercisePython Design PatternsPython Programming ExamplesPython Practice QuestionsJavaJava Programming LanguageJava TutorialData TypesVariablesOperatorsOperators in JavaArithmetic OperatorsUnary OperatorsAssignment OperatorsRelational OperatorsLogical OperatorsTernary OperatorsFlow Control in JavaFlow Controlif Statementif-else Statementif-else-if LadderContinue StatementBreak StatementReturn StatementLoops in JavaLoopsdo-while LoopFor LoopFor-each LoopMethodsStringsArraysOOPs ConceptsOOPs ConceptsClasses and ObjectsAccess ModifiersInheritanceAbstractionEncapsulationPolymorphismInterfacePackagesMultithreadingFile HandlingRegular ExpressionJava CollectionsJava CollectionsCollection ClassList InterfaceArrayListVector ClassStack ClassLinkedList ClassQueue InterfaceSet InterfaceHashSet ClassTreeSetMap InterfaceHashMap ClassHashTable ClassIteratorComparatorCollection Interview QuestionsJava 8 TutorialJava ProgramsJava Programming ExamplesJava Array ProgramsJava String ProgramsJava Date-Time ProgramsJava File Handling ProgramsJava Collection ProgramsJava JDBC ProgramsJava Apache POI ProgramsJava OpenCV ProgramsJava Interview QuestionsJava Interview QuestionsCore Java Interview Questions-FreshersJava Multithreading Interview QuestionsOOPs Interview Questions and AnswersJava ExercisesJava QuizJava QuizCore Java MCQJava ProjectsAdvance JavaSpring TutorialSpring Boot TutorialSpring Boot Interview QuestionsSpring MVC TutorialSpring MVC Interview QuestionsHibernate TutorialHibernate Interview QuestionsProgramming LanguagesCC++JavaScriptPHPR TutorialC#SQLScalaPerlGo LanguageKotlinSystem DesignSystem Design TutorialWhat is System DesignKey Terminologies in System DesignAnalysis and Architecture of SystemsScalability in System DesignDatabases in System DesignHigh Level Design or HLDLow Level Design or LLDCommunication ProtocolsWeb Servers and ProxiesCase Studies in Designing SystemsComplete System Design TutorialSoftware Design PatternsFactory PatternObserver PatternSingleton Design PatternDecorator PatternStrategy PatternAdapter PatternCommand PatternIterator PatternPrototype Design PatternAll Design PatternsSystem Design RoadmapTop 10 System Design Interview Questions and AnswersInterview CornerCompany PreparationTop TopicsPractice Company QuestionsInterview ExperiencesExperienced InterviewsInternship InterviewsCompetitive ProgrammingMultiple Choice QuizzesAptitude for PlacementsComputer Science SubjectsMathematicsOperating SystemDBMSComputer NetworksComputer Organization and ArchitectureTheory of ComputationCompiler DesignDigital LogicSoftware EngineeringDevOpsGITAWSDockerKubernetesMicrosoft Azure TutorialGoogle Cloud PlatformLinuxLinux TutorialLinux Commands A-ZLinux Commands Cheatsheet25 Basic Linux CommandsFile Mangement in LinuxFile Permission Commandschmod Commandchown Commandchgrp Commandunmask CommandLinux System AdministrationLinux File SystemLinux Shell ScriptingLinux NetworkingLinux FirewallLinux Interview QuestionsSoftware TestingSoftware Testing TutorialSoftware Testing TutorialWhat is Software TestingPrinciples of Software TestingTypes of Software TestingLevels of Software TestingAutomation TestingManual TestingTesting ToolsSoftware Testing ToolsDefect Testing ToolsCross-Browser Testing ToolsIntegration Testing ToolUnit Testing ToolsMobile Testing ToolsGUI Testing ToolSecurity Testing ToolsPenetration Testing ToolsSeleniumSelenium TutorialSelenium BasicsSelenium PythonJiraJira TutorialJIRA InstallationJIRA LoginJIRA DashboardSoftware EngineeringSoftware Engineering TutorialSoftware Development Life Cycle (SDLC)Software CharacteristicsSoftware QualityWaterfall ModelIterative Waterfall ModelSpiral ModelPrototyping ModelIncremental Process ModelInterview QuestionsSoftware Testing Interview QuestionsAutomation Testing Interview QuestionsManual Testing Interview QuestionsSoftware Engineering Interview QuestionsPenetration Testing Interview QuestionsAPI Testing Interview QuestionsPostmanPostman TutorialPostman for API DevelopmentDownload and Install PostmanAPI Testing Using PostmanGenerate HTML Report for PostmanDatabasesDBMS TutorialSQL TutorialPostgreSQL TutorialMongoDB TutorialSQL Interview QuestionsMySQL Interview QuestionsPL/SQL Interview QuestionsAndroidAndroid TutorialAndroid Studio TutorialKotlin For AndroidAndroid ProjectsAndroid Interview Questions6 Weeks of Android App DevelopmentExcelMS Excel TutorialIntroduction to MS ExcelData Analysis in ExcelBasic Excel Formulas & FunctionsData Analysis in Advanced ExcelWorkbooksStatistical FunctionsData Visualization in ExcelPivot Tables in ExcelExcel Spreadsheets in PythonBasic Excel ShortcutsMathematicsNumber SystemAlgebraLinear AlgebraTrigonometrySet TheoryStatisticsProbabilityGeometryMensurationLogarithmsCalculusCommerceBusiness StudiesAccountancyMicroeconomicsStatistics for EconomicsMacroeconomicsHuman Resource Management (HRM)ManagementIncome TaxFinanceCommerce Complete GuideSEO-Search Engine OptimizationWhat is SEOSearch Engine Optimization BasicsTypes of SEOKeyword Optimization in SEOBacklinks in SEOSEO BlogsMobile SEOSEO Complete ReferenceAptitudeAptitude Question and AnswersQuantitative AptitudeLogical ReasoningVerbal AbilityDSAData StructuresArraysMatrixStringsLinked ListSingly Linked ListDoubly Linked ListCircular Linked ListDoubly Circular Linked ListLinked List TutorialStackQueueTreeGeneric TreeBinary TreeBinary Search TreeAVL TreeB TreeB+ TreeRed Black TreeTree Data Structure TutorialHeapHashingGraphSet Data StructureMap Data StructureAdvanced Data StructureData Structures TutorialAlgorithmsAnalysis of AlgorithmsDesign and Analysis of AlgorithmsAsymptotic AnalysisAsymptotic NotationsWorst, Average and Best CasesSearching AlgorithmsLinear SearchBinary SearchSearching Algorithms TutorialSorting AlgorithmsSelection SortBubble SortInsertion SortMerge SortQuick SortHeap SortCounting SortRadix SortBucket SortSorting Algorithms TutorialGreedy AlgorithmsDynamic ProgrammingGraph AlgorithmsPattern SearchingRecursionBacktrackingDivide and ConquerMathematical AlgorithmsGeometric AlgorithmsBitwise AlgorithmsRandomized AlgorithmsBranch and BoundAlgorithms TutorialDSA TutorialPracticeAll DSA ProblemsProblem of the DayCompany Wise Coding PracticeAmazonMicrosoftFlipkartExplore AllGfG SDE SheetPractice Problems Difficulty WiseSchoolBasicEasyMediumHardLanguage Wise Coding PracticeCPPJavaPythonCurated DSA ListsBeginner's DSA SheetTop 50 Array ProblemsTop 50 String ProblemsTop 50 DP ProblemsTop 50 Graph ProblemsTop 50 Tree ProblemsCompetitive ProgrammingCompany Wise SDE SheetsFacebook SDE SheetAmazon SDE SheetApple SDE SheetNetflix SDE SheetGoogle SDE SheetDSA Cheat SheetsSDE SheetDSA Sheet for BeginnersFAANG Coding SheetProduct-Based Coding SheetCompany-Wise Preparation SheetTop Interview QuestionsTop 100 DSA Interview Questions Topic-wisePuzzlesAll PuzzlesTop 100 Puzzles Asked In InterviewsTop 20 Puzzles Commonly Asked During SDE InterviewsData SciencePython TutorialR TutorialMachine LearningData Science using PythonData Science using RData Science PackagesPandas TutorialNumPy TutorialData VisualizationPython Data Visualization TutorialData Visualization with RData AnalysisData Analysis with PythonData Analysis with RDeep LearningNLP TutorialWeb TechHTML TutorialCSS TutorialJavaScript TutorialPHP TutorialReactJS TutorialNodeJS TutorialAngularJS TutorialBootstrap TutorialWeb Development Using PythonDjangoGetting started with DjangoCreate an App in DjangoViews In DjangoDjango TemplatesDjango URL patternsDjango Admin InterfaceDjango ModelsMySQL Databased with DjangoDjango CRUDDjango FormsDjango Static FileProjects for BeginnersDjango TutorialFlaskWeb Development Using FlaskFlask App RoutingURL building in FlaskFlask TemplatesTemplating With Jinja2 in FlaskFlask ModelDatabase with Flask SQL AlchemyAuthentication with FlaskWTForms in FlaskStatic files in FlaskPython Flask ProjectsFlask Interview QuestionsFrontend ProjectsBuilding a Survey Form using HTML and CSSFood delivery system using HTML and CSSToDo webapp using DjangoBuilding Blog CMSAdd Pagination in DjangoTailwind CSS with DjangoDjango with ReactjsPostmanGithubJSON TutorialTypeScript TutorialWordpress TutorialWeb DesignWeb BrowsersGoogle ChromeMozilla FirefoxApple SafariMicrosoft EdgeTorCheat SheetsHTML Cheat SheetCSS Cheat SheetJavaScript Cheat SheetReact Cheat SheetAngular Cheat SheetjQuery Cheat SheetBootstrap Cheat SheetJavaScript ProjectsLearn Complete Web DevelopmentFile FormatsCoursesCoding for EveryoneDSA to DevelopmentMachine Learning and Data ScienceDSA CoursesData Structure & Algorithm(C++/JAVA)Data Structure & Algorithm(Python)Data Structure & Algorithm(JavaScript)Programming LanguagesCPPJavaPythonJavaScriptC

Home

Saved Videos

Courses

Data Structures and Algorithms

DSA Tutorial

Data Structures Tutorial

Algorithms Tutorial

Top 100 DSA Interview Questions

DSA-Roadmap[Basic-to-Advanced]

ML & Data Science

Learn Python

Data Science Tutorial

Machine Learning Tutorial

Deep Learning Tutorial

NLP Tutorial

Computer Vision Tutorial

Web Development

HTML Tutorial

CSS Tutorial

JavaScript Tutorial

ReactJS Tutorial

NodeJS Tutorial

Languages

C

C++

Java

R Tutorial

Golang

Interview Corner

Company Interview Corner

Experienced Interviews

Internship Experiences

Practice Company Questions

Competitive Programming

CS Subjects

Operating Systems

DBMS

Computer Networks

Software Engineering

Software Testing

Jobs

Get Hired: Apply for Jobs

Job-a-thon: Hiring Challenge

Corporate Hiring Solutions

Practice

All DSA Problems

Problem of the Day

GFG SDE Sheet

Beginner's DSA Sheet

Love Babbar Sheet

Top 50 Array Problems

Top 50 String Problems

Top 50 DP Problems

Top 50 Graph Problems

Top 50 Tree Problems

Contests

World Cup Hack-A-Thon

GFG Weekly Coding Contest

Job-A-Thon: Hiring Challenge

BiWizard School Contest

All Contests and Events

GBlog

Puzzles

What's New ?

Change Language

AptitudeEngineering MathematicsDiscrete MathematicsOperating SystemDBMSComputer NetworksDigital Logic and DesignC ProgrammingData StructuresAlgorithmsTheory of ComputationCompiler DesignComputer Org and Architecture

▲

Open In App

CCNA Tutorial for BeginnersBasics of Computer NetworkingNetwork and CommunicationLAN Full FormWhat is OSI Model? - Layers of OSI ModelTCP/IP ModelHow Data Encapsulation & De-encapsulation Works?Components of Computer NetworkingNIC Full FormWhat is a network switch, and how does it work?What is Network Hub and How it Works?Introduction of a RouterTypes of Ethernet CableTransport LayerTransport Layer responsibilitiesIntroduction of Ports in ComputersWhat is Transmission Control Protocol (TCP)?TCP 3-Way Handshake ProcessUser Datagram Protocol (UDP)Network LayerIntroduction and IPv4 Datagram HeaderDifference between Unicast, Broadcast and Multicast in Computer NetworkStructure and Types of IP AddressIPv4 AddressingWhat is IPv4?Role of Subnet MaskIntroduction of Classful IP AddressingSubnettingIntroduction To SubnettingClassless Inter Domain Routing (CIDR)Introduction of Variable Length Subnet Mask (VLSM)Private IP Addresses in NetworkingData Link LayerWhat is Ethernet?What is MAC Address?What is an IP Address?Physical LayerEthernet Frame FormatWhat is Power Over Ethernet (POE)?Cisco Networking DevicesNetwork Devices (Hub, Repeater, Bridge, Switch, Router, Gateways and Brouter)Collision Detection in CSMA/CDCollision Domain and Broadcast Domain in Computer NetworkDifference between layer-2 and layer-3 switchesLife of a PacketWorking of Domain Name System (DNS) ServerConfiguring DHCP and Web Server in Cisco Packet TracerHow Address Resolution Protocol (ARP) works?Router and Switch Basic ConfigurationCisco Router basic commandsConfigure IP Address for Interface in Cisco SwitchesTransmission Modes in Computer Networks (Simplex, Half-Duplex and Full-Duplex)Link Layer Discovery Protocol (LLDP)What is Cisco Discovery Protocol (CDP)?Cisco Device ManagementWhat are the different memories used in a CISCO router?Router Boot SequenceRecovering password in Cisco RoutersCatalyst Switch Password Reset in CiscoProcess of Backing Up and Restoring the Cisco IOSFile Transfer Protocol (FTP)Difference between FTP and TFTPBacking up Cisco IOS Router imageSteps Involves in Cisco Router Configuration BackupsBasic Network Trouble shootingTroubleshooting Questions on OS and Networking asked in Cloud based InterviewInternet Control Message Protocol (ICMP)What is Ping?traceroute command in Linux with ExamplesIPv4 RoutingWhat is IP Routing?Routing Tables in Computer NetworkDifference between Static and Dynamic RoutingWhat is Floating Static Route ?How to Add a Static Route to Windows Routing Table?Dynamic Routing ProtocolsRouting Protocol CodeDifference between IGRP and BGPAdministrative Distance (AD) and Autonomous System (AS)Configuring a Loopback Interface in CiscoWhat is a Loopback Address?What is Passive-Interface Command Behavior in RIP, EIGRP & OSPF?Interior Gateway ProtocolsRouting Information Protocol (RIP)Configuring RIP Default Information Originate in CiscoConfiguring RIP Versions 1 and 2 in CiscoEIGRP fundamentalsFeatures of Enhanced Interior Gateway Routing Protocol (EIGRP)Types of EIGRP Packet in Computer NetworkHow to Configure EIGRP Summarization in Cisco?Open Shortest Path First(OSPF)Open shortest path first (OSPF) router roles and configurationDifference between EIGRP and OSPFBandwidth Allocation Control Protocol (BACP)Open shortest path first (OSPF) - Set 2OSPF ImplementationExplain OSPF DR/BDR Election?Configuring OSPF Passive Interface in CiscoConfiguring OSPF Default Route PropagationConfiguring OSPF Maximum PathsConfiguring OSPF Route Summarization in CiscoConfiguring OSPF Network Types in CiscoVirtual Local Area Network(VLAN)Three-Layer Hierarchical Model in Cisco2 - Tier And 3 - Tier Architecture in NetworkingSpine-Leaf ArchitectureVirtual LAN (VLAN)Configuring and Verifying VLANs in CiscoAccess and Trunk PortsWhat is ISL(Inter-Switch Link)?Inter-Switch Link (ISL) and IEEE 802.1QAccess Ports (Data and Voice) in CCNAAccess Ports (Data and Voice) in CCNADynamic Trunking Protocol (DTP)VLAN Trunking Protocol (VTP)What are the VTP Modes?Inter-V LAN RoutingInter VLAN Routing by Layer 3 SwitchConfiguration of Router on a stickDynamic Host Control Protocol(DHCP)Difference between DNS and DHCPHow to Configure DHCP Server on a Cisco Router?DHCP Relay Agent in Computer NetworkWhat is APIPA (Automatic Private IP Addressing)?Hot Standby Routing Protocol(HSRP)Redundant Link problems in Computer NetworkFirsthop Redundancy ProtocolHot Standby Router Protocol (HSRP)Spanning Tree Protocol(STP)Introduction of Spanning Tree Protocol (STP)What is Bridge in Computer Network - Types, Uses, Functions & DifferencesWorking of Spanning Tree Protocol (STP)Root Bridge Election in Spanning Tree ProtocolHow Spanning Tree Protocol (STP) Select Designated Port?Types of Spanning Tree Protocol (STP)Rapid Spanning Tree ProtocolConfiguring Spanning Tree Protocol PortfastEthernet ChannelEtherChannel in Computer NetworkConfigure, Verify and Troubleshoot (Layer 2/Layer 3) EtherChannelLink Aggregation Control ProtocolSwitch SecurityDHCP SnoopingWireless Security | Set 1Port Security in Computer NetworkConfiguring Port Security on Cisco IOS SwitchAccess Control List(ACL)Standard Access-ListStatic NAT Configuration in CiscoDynamic NAT Configuration in CiscoExtended Access-ListReflexive Access-ListIPv6 Addressing and RoutingWhat is IPv6?Internet Protocol version 6 (IPv6)IPv6 EUI-64 (Extended Unique Identifier)Differences between IPv4 and IPv6Global Unicast Address in CCNALink Local AddressWhat is IPv6 Address Planning?How to Configure IPv6 on CISCO Router?What is IPv6 Stateless Address Autoconfiguration ?RPL (IPv6 Routing protocol)Wide Area NetworkWAN Full FormWhat is VPN and How It Works?Overview of Wireless Wide Area Network (WWAN)Multi Protocol Label Switching (MPLS)Point-to-Point Protocol (PPP) SuiteSecurity ConceptsTypes of Cyber AttacksTypes of Network FirewallIntroduction of Firewall in Computer NetworkIntrusion Detection System (IDS)Intrusion Prevention System (IPS)Difference Between Symmetric and Asymmetric Key EncryptionHTTP Full FormExplain the Working of HTTPSWhat is Attack Mitigation?Network Device SecurityTELNET and SSH in Cisco devicesHow to configure SSH Client in Linux ?AAA (Authentication, Authorization and Accounting) configuration (locally)RADIUS ProtocolTACACS+ ProtocolNetwork Time Protocol (NTP)Configure and Verify NTP Operating in Client and Server ModeNetwork Device ManagementWhat is Syslog server and its working ?Command-Line Tools and Utilities For Network Management in LinuxSimple Network Management Protocol (SNMP)Overview of SNMPv3Wireless NetworkingWired and Wireless NetworkingWhat is a Wireless Access Point?Cisco Wireless Architecture and AP ModesPhysical Infrastructure Connections of WLAN ComponentsWiFi and its AmendmentsTypes of Wireless Security Encryption

CCNA Tutorial for BeginnersBasics of Computer NetworkingNetwork and CommunicationLAN Full FormWhat is OSI Model? - Layers of OSI ModelTCP/IP ModelHow Data Encapsulation & De-encapsulation Works?Components of Computer NetworkingNIC Full FormWhat is a network switch, and how does it work?What is Network Hub and How it Works?Introduction of a RouterTypes of Ethernet CableTransport LayerTransport Layer responsibilitiesIntroduction of Ports in ComputersWhat is Transmission Control Protocol (TCP)?TCP 3-Way Handshake ProcessUser Datagram Protocol (UDP)Network LayerIntroduction and IPv4 Datagram HeaderDifference between Unicast, Broadcast and Multicast in Computer NetworkStructure and Types of IP AddressIPv4 AddressingWhat is IPv4?Role of Subnet MaskIntroduction of Classful IP AddressingSubnettingIntroduction To SubnettingClassless Inter Domain Routing (CIDR)Introduction of Variable Length Subnet Mask (VLSM)Private IP Addresses in NetworkingData Link LayerWhat is Ethernet?What is MAC Address?What is an IP Address?Physical LayerEthernet Frame FormatWhat is Power Over Ethernet (POE)?Cisco Networking DevicesNetwork Devices (Hub, Repeater, Bridge, Switch, Router, Gateways and Brouter)Collision Detection in CSMA/CDCollision Domain and Broadcast Domain in Computer NetworkDifference between layer-2 and layer-3 switchesLife of a PacketWorking of Domain Name System (DNS) ServerConfiguring DHCP and Web Server in Cisco Packet TracerHow Address Resolution Protocol (ARP) works?Router and Switch Basic ConfigurationCisco Router basic commandsConfigure IP Address for Interface in Cisco SwitchesTransmission Modes in Computer Networks (Simplex, Half-Duplex and Full-Duplex)Link Layer Discovery Protocol (LLDP)What is Cisco Discovery Protocol (CDP)?Cisco Device ManagementWhat are the different memories used in a CISCO router?Router Boot SequenceRecovering password in Cisco RoutersCatalyst Switch Password Reset in CiscoProcess of Backing Up and Restoring the Cisco IOSFile Transfer Protocol (FTP)Difference between FTP and TFTPBacking up Cisco IOS Router imageSteps Involves in Cisco Router Configuration BackupsBasic Network Trouble shootingTroubleshooting Questions on OS and Networking asked in Cloud based InterviewInternet Control Message Protocol (ICMP)What is Ping?traceroute command in Linux with ExamplesIPv4 RoutingWhat is IP Routing?Routing Tables in Computer NetworkDifference between Static and Dynamic RoutingWhat is Floating Static Route ?How to Add a Static Route to Windows Routing Table?Dynamic Routing ProtocolsRouting Protocol CodeDifference between IGRP and BGPAdministrative Distance (AD) and Autonomous System (AS)Configuring a Loopback Interface in CiscoWhat is a Loopback Address?What is Passive-Interface Command Behavior in RIP, EIGRP & OSPF?Interior Gateway ProtocolsRouting Information Protocol (RIP)Configuring RIP Default Information Originate in CiscoConfiguring RIP Versions 1 and 2 in CiscoEIGRP fundamentalsFeatures of Enhanced Interior Gateway Routing Protocol (EIGRP)Types of EIGRP Packet in Computer NetworkHow to Configure EIGRP Summarization in Cisco?Open Shortest Path First(OSPF)Open shortest path first (OSPF) router roles and configurationDifference between EIGRP and OSPFBandwidth Allocation Control Protocol (BACP)Open shortest path first (OSPF) - Set 2OSPF ImplementationExplain OSPF DR/BDR Election?Configuring OSPF Passive Interface in CiscoConfiguring OSPF Default Route PropagationConfiguring OSPF Maximum PathsConfiguring OSPF Route Summarization in CiscoConfiguring OSPF Network Types in CiscoVirtual Local Area Network(VLAN)Three-Layer Hierarchical Model in Cisco2 - Tier And 3 - Tier Architecture in NetworkingSpine-Leaf ArchitectureVirtual LAN (VLAN)Configuring and Verifying VLANs in CiscoAccess and Trunk PortsWhat is ISL(Inter-Switch Link)?Inter-Switch Link (ISL) and IEEE 802.1QAccess Ports (Data and Voice) in CCNAAccess Ports (Data and Voice) in CCNADynamic Trunking Protocol (DTP)VLAN Trunking Protocol (VTP)What are the VTP Modes?Inter-V LAN RoutingInter VLAN Routing by Layer 3 SwitchConfiguration of Router on a stickDynamic Host Control Protocol(DHCP)Difference between DNS and DHCPHow to Configure DHCP Server on a Cisco Router?DHCP Relay Agent in Computer NetworkWhat is APIPA (Automatic Private IP Addressing)?Hot Standby Routing Protocol(HSRP)Redundant Link problems in Computer NetworkFirsthop Redundancy ProtocolHot Standby Router Protocol (HSRP)Spanning Tree Protocol(STP)Introduction of Spanning Tree Protocol (STP)What is Bridge in Computer Network - Types, Uses, Functions & DifferencesWorking of Spanning Tree Protocol (STP)Root Bridge Election in Spanning Tree ProtocolHow Spanning Tree Protocol (STP) Select Designated Port?Types of Spanning Tree Protocol (STP)Rapid Spanning Tree ProtocolConfiguring Spanning Tree Protocol PortfastEthernet ChannelEtherChannel in Computer NetworkConfigure, Verify and Troubleshoot (Layer 2/Layer 3) EtherChannelLink Aggregation Control ProtocolSwitch SecurityDHCP SnoopingWireless Security | Set 1Port Security in Computer NetworkConfiguring Port Security on Cisco IOS SwitchAccess Control List(ACL)Standard Access-ListStatic NAT Configuration in CiscoDynamic NAT Configuration in CiscoExtended Access-ListReflexive Access-ListIPv6 Addressing and RoutingWhat is IPv6?Internet Protocol version 6 (IPv6)IPv6 EUI-64 (Extended Unique Identifier)Differences between IPv4 and IPv6Global Unicast Address in CCNALink Local AddressWhat is IPv6 Address Planning?How to Configure IPv6 on CISCO Router?What is IPv6 Stateless Address Autoconfiguration ?RPL (IPv6 Routing protocol)Wide Area NetworkWAN Full FormWhat is VPN and How It Works?Overview of Wireless Wide Area Network (WWAN)Multi Protocol Label Switching (MPLS)Point-to-Point Protocol (PPP) SuiteSecurity ConceptsTypes of Cyber AttacksTypes of Network FirewallIntroduction of Firewall in Computer NetworkIntrusion Detection System (IDS)Intrusion Prevention System (IPS)Difference Between Symmetric and Asymmetric Key EncryptionHTTP Full FormExplain the Working of HTTPSWhat is Attack Mitigation?Network Device SecurityTELNET and SSH in Cisco devicesHow to configure SSH Client in Linux ?AAA (Authentication, Authorization and Accounting) configuration (locally)RADIUS ProtocolTACACS+ ProtocolNetwork Time Protocol (NTP)Configure and Verify NTP Operating in Client and Server ModeNetwork Device ManagementWhat is Syslog server and its working ?Command-Line Tools and Utilities For Network Management in LinuxSimple Network Management Protocol (SNMP)Overview of SNMPv3Wireless NetworkingWired and Wireless NetworkingWhat is a Wireless Access Point?Cisco Wireless Architecture and AP ModesPhysical Infrastructure Connections of WLAN ComponentsWiFi and its AmendmentsTypes of Wireless Security Encryption

Ethernet Frame Format

Improve

Improve

Improve

Like Article

Like

Save Article

Save

Share

Report issue

Report

Prerequisite – Introduction to Ethernet

Basic frame format which is required for all MAC implementation is defined in IEEE 802.3 standard. Though several optional formats are being used to extend the protocol’s basic capability. Ethernet frame starts with Preamble and SFD, both work at the physical layer. Ethernet header contains both the Source and Destination MAC address, after which the payload of the frame is present. The last field is CRC which is used to detect the error. Now, let’s study each field of basic frame format.

Ethernet (IEEE 802.3) Frame Format:

PREAMBLE – Ethernet frame starts with a 7-Bytes Preamble. This is a pattern of alternative 0’s and 1’s which indicates starting of the frame and allow sender and receiver to establish bit synchronization. Initially, PRE (Preamble) was introduced to allow for the loss of a few bits due to signal delays. But today’s high-speed Ethernet doesn’t need Preamble to protect the frame bits. PRE (Preamble) indicates the receiver that frame is coming and allow the receiver to lock onto the data stream before the actual frame begins.Start of frame delimiter (SFD) – This is a 1-Byte field that is always set to 10101011. SFD indicates that upcoming bits are starting the frame, which is the destination address. Sometimes SFD is considered part of PRE, this is the reason Preamble is described as 8 Bytes in many places. The SFD warns station or stations that this is the last chance for synchronization.Destination Address – This is a 6-Byte field that contains the MAC address of the machine for which data is destined.Source Address – This is a 6-Byte field that contains the MAC address of the source machine. As Source Address is always an individual address (Unicast), the least significant bit of the first byte is always 0.Length – Length is a 2-Byte field, which indicates the length of the entire Ethernet frame. This 16-bit field can hold a length value between 0 to 65534, but length cannot be larger than 1500 Bytes because of some own limitations of Ethernet.Data – This is the place where actual data is inserted, also known as Payload. Both IP header and data will be inserted here if Internet Protocol is used over Ethernet. The maximum data present may be as long as 1500 Bytes. In case data length is less than minimum length i.e. 46 bytes, then padding 0’s is added to meet the minimum possible length.Cyclic Redundancy Check (CRC) – CRC is 4 Byte field. This field contains a 32-bits hash code of data, which is generated over the Destination Address, Source Address, Length, and Data field. If the checksum computed by destination is not the same as sent checksum value, data received is corrupted.VLAN Tagging – The Ethernet frame can also include a VLAN (Virtual Local Area Network) tag, which is a 4-byte field inserted after the source address and before the EtherType field. This tag allows network administrators to logically separate a physical network into multiple virtual networks, each with its own VLAN ID.Jumbo Frames – In addition to the standard Ethernet frame size of 1518 bytes, some network devices support Jumbo Frames, which are frames with a payload larger than 1500 bytes. Jumbo Frames can increase network throughput by reducing the overhead associated with transmitting a large number of small frames.Ether Type Field – The EtherType field in the Ethernet frame header identifies the protocol carried in the payload of the frame. For example, a value of 0x0800 indicates that the payload is an IP packet, while a value of 0x0806 indicates that the payload is an ARP (Address Resolution Protocol) packet.Multicast and Broadcast Frames –  In addition to Unicast frames (which are sent to a specific destination MAC address), Ethernet also supports Multicast and Broadcast frames. Multicast frames are sent to a specific group of devices that have joined a multicast group, while Broadcast frames are sent to all devices on the network.Collision Detection – In half-duplex Ethernet networks, collisions can occur when two devices attempt to transmit data at the same time. To detect collisions, Ethernet uses a Carrier Sense Multiple Access with Collision Detection (CSMA/CD) protocol, which listens for activity on the network before transmitting data and backs off if a collision is detected.

Note: Size of frame of Ethernet IEEE 802.3 varies 64 bytes to 1518 bytes including data length (46 to 1500 bytes).

Brief overview on Extended Ethernet Frame (Ethernet II Frame):

Standard IEEE 802.3 basic frame format is discussed above in detail. Now let’s see the extended Ethernet frame header, using which we can get a Payload even larger than 1500 Bytes. 

DA [Destination MAC Address]: 6 bytes SA [Source MAC Address]: 6 bytes Type [0x8870 (Ethertype)]: 2 bytes DSAP [802.2 Destination Service Access Point] : 1 byte SSAP [802.2 Source Service Access Point] : 1 byte Ctrl [802.2 Control Field] : 1-byte Data [Protocol Data] : > 46 bytes FCS [Frame Checksum]: 4 bytes Although length field is missing in Ethernet II frame, the frame length is known by virtue of the frame being accepted by the network interface. GATE CS Corner Questions Practicing the following questions will help you test your knowledge. All questions have been asked in GATE in previous years or in GATE Mock Tests. It is highly recommended that you practice them.

GATE CS 2007, Question 85GATE CS 2005, Question 74GATE CS 2004, Question 90GATE IT 2005, Question 27GATE CS 2016 (Set 2), Question 34Advantages:

Simple format: The Ethernet frame format is simple and easy to understand, making it easy to implement and troubleshoot Ethernet networks.

Flexibility: The Ethernet frame format is flexible and can accommodate different data sizes and network topologies, making it suitable for a wide range of network applications.

Widely adopted: The Ethernet frame format is widely adopted and supported by a large number of vendors and network devices, ensuring compatibility and interoperability.

Error detection: The Ethernet frame format includes a cyclic redundancy check (CRC) field for error detection, which helps to ensure data integrity during transmission.

Support for VLANs: The Ethernet frame format supports virtual local area networks (VLANs), which allows network administrators to logically partition a physical LAN into multiple smaller virtual LANs for improved network management and security.

Disadvantages:

Limited frame size: The Ethernet frame format has a maximum frame size of 1500 bytes, which can limit the amount of data that can be transmitted in a single frame and can result in increased overhead due to fragmentation and reassembly of larger packets.

Broadcast storms: Ethernet networks use broadcast transmissions to send frames to all devices on the network, which can lead to broadcast storms if too many devices send broadcast frames simultaneously, resulting in network congestion and performance issues.

Security vulnerabilities: The Ethernet frame format does not include built-in security features, making Ethernet networks vulnerable to security threats such as eavesdropping and spoofing.

Limited speed: Ethernet networks have a limited maximum speed, which may not be sufficient for high-speed applications or large-scale networks.

Limited distance: The maximum distance between two devices on an Ethernet network is limited, which can restrict the physical coverage of the network.

Last Updated :

04 May, 2023

Like Article

Save Article

Previous

What is an IP Address?

Next

What is Power Over Ethernet (POE)?

Share your thoughts in the comments

Add Your Comment

Please Login to comment...

Similar Reads

Difference between Fast Ethernet and Gigabit Ethernet

What is Minimum Ethernet Frame Size?

Token Ring frame format

Link Access Procedure, Balanced (LAPB) Frame Format

Point-to-Point Protocol (PPP) Frame Format

Frame Format of BISYNC

Difference between Ethernet and LAN

Difference between Wi-Fi and Ethernet

Difference between Token ring and Ethernet

Metro Ethernet (MetroE)

Like

GeeksforGeeks

Article Tags :

Computer Networks

GATE CS

Misc

Practice Tags :

Misc

Additional Information

Current difficulty :

Easy

Vote for difficulty :

Easy

Normal

Medium

Hard

Expert

Improved By :

VaibhavRai3abhishekaslkrenukawadetwarrrr788j8p9

Trending in News

View More

How to Make Faceless Snapchat Shows Earning $1,000/DayZepto Pass Hits 1 Million Subscribers in Just One WeekChina’s "AI Plus": An Initiative To Transform IndustriesTop 10 Free Apps for Chatting Dev Scripter 2024 - Biggest Technical Writing Event By GeeksforGeeks

Explore More

A-143, 9th Floor, Sovereign Corporate Tower, Sector-136, Noida, Uttar Pradesh - 201305

CompanyAbout UsLegalCareersIn MediaContact UsAdvertise with usGFG Corporate SolutionPlacement Training ProgramExploreHack-A-ThonsGfG Weekly ContestDSA in JAVA/C++Master System DesignMaster CPGeeksforGeeks VideosGeeks CommunityLanguagesPythonJavaC++PHPGoLangSQLR LanguageAndroid TutorialTutorials ArchiveDSAData StructuresAlgorithmsDSA for BeginnersBasic DSA ProblemsDSA RoadmapTop 100 DSA Interview ProblemsDSA Roadmap by Sandeep JainAll Cheat SheetsData Science & MLData Science With PythonData Science For BeginnerMachine Learning TutorialML MathsData Visualisation TutorialPandas TutorialNumPy TutorialNLP TutorialDeep Learning TutorialHTML & CSSHTMLCSSWeb TemplatesCSS FrameworksBootstrapTailwind CSSSASSLESSWeb DesignDjango TutorialPythonPython Programming ExamplesPython ProjectsPython TkinterWeb ScrapingOpenCV Python TutorialPython Interview QuestionComputer ScienceOperating SystemsComputer NetworkDatabase Management SystemSoftware EngineeringDigital Logic DesignEngineering MathsDevOpsGitAWSDockerKubernetesAzureGCPDevOps RoadmapCompetitive ProgrammingTop DS or Algo for CPTop 50 TreeTop 50 GraphTop 50 ArrayTop 50 StringTop 50 DPTop 15 Websites for CPSystem DesignHigh Level DesignLow Level DesignUML DiagramsInterview GuideDesign PatternsOOADSystem Design BootcampInterview QuestionsJavaScriptJavaScript ExamplesTypeScriptReactJSNextJSAngularJSNodeJSLodashWeb BrowserPreparation CornerCompany-Wise Recruitment ProcessResume TemplatesAptitude PreparationPuzzlesCompany-Wise PreparationSchool SubjectsMathematicsPhysicsChemistryBiologySocial ScienceEnglish GrammarWorld GKManagement & FinanceManagementHR ManagementFinanceIncome TaxOrganisational BehaviourMarketingFree Online ToolsTyping TestImage EditorCode FormattersCode ConvertersCurrency ConverterRandom Number GeneratorRandom Password GeneratorMore TutorialsSoftware DevelopmentSoftware TestingProduct ManagementSAPSEO - Search Engine OptimizationLinuxExcelGeeksforGeeks VideosDSAPythonJavaC++Data ScienceCS Subjects

@GeeksforGeeks, Sanchhaya Education Private Limited, All rights reserved

We use cookies to ensure you have the best browsing experience on our website. By using our site, you

acknowledge that you have read and understood our

Cookie Policy &

Privacy Policy

Got It !

Improvement

Please go through our recently updated Improvement Guidelines before submitting any improvements.

This article is being improved by another user right now. You can suggest the changes for now and it will be under the article's discussion tab.

You will be notified via email once the article is available for improvement.

Thank you for your valuable feedback!

Suggest changes

Please go through our recently updated Improvement Guidelines before submitting any improvements.

Suggest Changes

Help us improve. Share your suggestions to enhance the article. Contribute your expertise and make a difference in the GeeksforGeeks portal.

Create Improvement

Enhance the article with your expertise. Contribute to the GeeksforGeeks community and help create better learning resources for all.

Suggest Changes

Suggestion[CharLimit:2000]

Create Improvement

What kind of Experience do you want to share?

Interview Experiences

Admission Experiences

Engineering Exam Experiences

Work Experiences

Campus Experiences

Add Other Experiences

以太网帧格式 - 维基百科，自由的百科全书

以太网帧格式 - 维基百科，自由的百科全书

跳转到内容

主菜单

主菜单

移至侧栏

隐藏

导航

首页分类索引特色内容新闻动态最近更改随机条目资助维基百科

帮助

帮助维基社群方针与指引互助客栈知识问答字词转换IRC即时聊天联络我们关于维基百科

搜索

搜索

创建账号

登录

个人工具

创建账号 登录

未登录编辑者的页面 了解详情

贡献讨论

目录

移至侧栏

隐藏

序言

1结构

开关结构子章节

1.1前导码和帧开始符

1.2报头

1.3帧校验码

1.4帧间距

2以太帧类型

开关以太帧类型子章节

2.1Ethernet II

2.2802.2 LLC

2.3子网接入协议

2.4Novell raw 802.3

3效率

4矮帧

5注释

6参考资料

开关目录

以太网帧格式

12种语言

CatalàČeštinaDeutschEnglishEspañolBahasa IndonesiaItaliano日本語한국어SvenskaTürkçeTiếng Việt

编辑链接

条目讨论

大陆简体

不转换简体繁體大陆简体香港繁體澳門繁體大马简体新加坡简体臺灣正體

阅读编辑查看历史

工具

工具

移至侧栏

隐藏

操作

阅读编辑查看历史

常规

链入页面相关更改上传文件特殊页面固定链接页面信息引用本页获取短URL下载二维码维基数据项目

打印/导出

下载为PDF可打印版

维基百科，自由的百科全书

此条目可参照英语维基百科相应条目来扩充。 (2019年8月27日)若您熟悉来源语言和主题，请协助参考外语维基百科扩充条目。请勿直接提交机械翻译，也不要翻译不可靠、低品质内容。依版权协议，译文需在编辑摘要注明来源，或于讨论页顶部标记{{Translated page}}标签。

此条目需要补充更多来源。 (2019年8月27日)请协助补充多方面可靠来源以改善这篇条目，无法查证的内容可能会因为异议提出而被移除。致使用者：请搜索一下条目的标题（来源搜索："以太网帧格式" — 网页、新闻、书籍、学术、图像），以检查网络上是否存在该主题的更多可靠来源（判定指引）。

在以太网链路上的数据包称作以太帧。以太帧起始部分由前导码和帧开始符组成。后面紧跟着一个以太网报头，以MAC地址说明目的地址和源地址。帧的中部是该帧负载的包含其他协议报头的数据包（例如IP协议）。以太帧由一个32位冗余校验码结尾。它用于检验数据传输是否出现损坏。

结构[编辑]

来自线路的二进制数据包称作一个帧。从物理线路上看到的帧，除其他信息外，还可看到前导码和帧开始符。任何物理硬件都会需要这些信息。[note 1]

下面的表格显示了在以1500个八比特组为MTU传输（有些吉比特以太网甚至更高速以太网支持更大的帧，称作巨型帧）时的完整帧格式。[note 2] 一个八比特组是八个位组成的数据（也就是现代计算机的一个字节）。

802.3 以太网帧结构

前导码

帧开始符

MAC 目标地址

MAC 源地址

802.1Q 标签 （可选）

以太类型

负载

冗余校验

帧间距（英语：Interframe gap）

10101010 7个octet

10101011 1个octet

6 octets

6 octets

（4 octets）

2 octets

46–1500 octets

4 octets

12 octets

64–1522 octets

72–1530 octets

84–1542 octets

前导码和帧开始符[编辑]

参见：Syncword

一个帧以7个字节的前导码和1个字节的帧开始符作为帧的开始。快速以太网之前，在线路上帧的这部分的位模式是10101010 10101010 10101010 10101010 10101010 10101010 10101010 10101011。由于在传输一个字节时最低位最先传输（LSB），因此其相应的16进制表示为0x55 0x55 0x55 0x55 0x55 0x55 0x55 0xD5。

10/100M 网卡（介质无关接口 PHY）一次传输4位（一个半字节（英语：nibble））。因此前导符会成为7组0x5+0x5,而帧开始符成为0x5+0xD。1000M网卡（GMII（英语：Gigabit Media Independent Interface））一次传输8位，而10Gbit/s（XGMII（英语：nibble）） PHY芯片一次传输32位。 注意当以octet描述时，先传输7个01010101然后传输11010101。由于8位数据的低4位先发送，所以先发送帧开始符的0101，之后发送1101。

报头[编辑]

报头包含源地址和目标地址的MAC地址，以太类型字段和可选的用于说明VLAN成员关系和传输优先级的IEEE 802.1Q VLAN 标签。

帧校验码[编辑]

帧校验码是一个32位循环冗余校验码，以便验证帧数据是否被损坏。

帧间距[编辑]

主条目：en:Interframe gap

当一个帧发送出去之后，发送方在下次发送帧之前，需要再发送至少12个octet的空闲线路状态码。

以太帧类型[编辑]

以太帧有很多种类型。不同类型的帧具有不同的格式和MTU值。但在同种物理媒体上都可同时存在。

以太网第二版[note 3] 或者称之为Ethernet II 帧，DIX帧，是最常见的帧类型。并通常直接被IP协议使用。

Novell的非标准IEEE 802.3帧变种。

IEEE 802.2 逻辑链路控制 （LLC） 帧

子网接入协议（SNAP）帧

所有四种以太帧类型都可包含一个IEEE 802.1Q选项来确定它属于哪个VLAN以及他的IEEE 802.1p优先级（QoS）。这个封装由IEEE 802.3ac定义并将帧大小从64字节扩充到1522字节（注：不包含7个前导字节和1个字节的帧开始符以及12个帧间距字节）。

IEEE 802.1Q标签，如果出现，需要放在源地址字段和以太类型或长度字段的中间。这个标签的前两个字节是标签协议标识符（TPID）值0x8100。这与没有标签帧的以太类型/长度字段的位置相同，所以以太类型0x8100就表示包含标签的帧，而实际的以太类型/长度字段则放在Q-标签的后面。TPID后面是两个字节的标签控制信息（TCI）。（IEEE 802.1p 优先级（QoS）和VLAN ID）。Q标签后面就是通常的帧内容。

Ethernet II[编辑]

以太 II 帧 （也称作DIX以太网，是以这个设计的主要成员，DEC,Intel和Xerox的名字命名的。[1]）,把紧接在目标和源MAC地址后面的这个两字节定义为以太网帧数据类型字段。

例如，一个0x0800的以太类型说明这个帧包含的是IPv4数据报。同样的，一个0x0806的以太类型说明这个帧是一个ARP帧，0x8100说明这是一个IEEE 802.1Q帧，而0x86DD说明这是一个IPv6帧。

当这个工业界的标准通过正式的IEEE标准化过程后，在802.3标准中以太类型字段变成了一个（数据）长度字段。（最初的以太包通过包括他们的帧来确定它们的长度，而不是以一个明确的数值。）但是包的接收层仍需知道如何解析包，因此标准要求将IEEE802.2头跟在长度字段后面，定义包的类型。多年之后，802.3x-1997标准，一个802.3标准的后继版本，正式允许两种类型的数据包同时存在。实际上，两种数据包都被广泛使用，而最初的以太数据包在以太局域网中被广泛应用，因为他的简便和低开销。

为了允许一些使用以太II版本的数据报和一些使用802.3封装的最初版本的数据包能够在同一个以太网段使用，以太类型值必须大于等于1536（0x0600）。这个值比802.3数据包的最大长度1500byte （0x05DC）要更大。因此如果这个字段的值大于等于1536，则这个帧是以太II帧，而那个字段是类型字段。否则（小于1500而大于46字节），他是一个IEEE 802.3帧，而那个字段是长度字段。1500～1536（不包含）的数值未定义。[2]

802.2 LLC[编辑]

一些协议，尤其是为OSI模型设计的，会直接在802.2 LLC层上操作。802.2 LLC层同时提供数据报和面向连接的网络服务。

802.2以太网变种没有在常规网络中普遍使用。只有一些大公司的没有与IP网络融合的Netware设备。以前，很多公司Netware网络支持802.2以太网，以便支持从以太网到IEEE 802.5令牌环网或FDDI网络的透明桥接。当今最流行的数据包是以太网版本二，由基于IP协议的网络使用，将其以太类型设置为0x0800用于封装IPv4或者0x86DD来支持IPv6。

还有一个互联网标准来使用LLC/SNAP报头将IPv4封装在IEEE 802.2帧中。[3] 这几乎从未在以太网中实现过。（但在FDDI以及令牌环网，IEEE 802.11和其他IEEE 802网络中使用）。如果不使用SNAP,IP传输无法封装在IEEE 802.2 LLC帧中。这是因为LLC协议中虽然有一种IP协议类型，却没有ARP。IPv6同样可使用LLC/SNAP在IEEE 802.2以太网上传播，但，如同IPv4，它也绝少被这样使用。（尽管LLC/SNAP的IPv6数据包在IEEE 802网络中被使用）。

子网接入协议[编辑]

通过检查802.2 LLC头，可以确定他是否后继一个SNAP头。LLC头包含两个附加的8位地址字段，在OSI模型术语中称作服务访问点（SAPs）。当源和目标SAP都设置为0xAA时，就会使用SNAP服务。SNAP头允许以太类型值被任何IEEE 802协议使用，即使支持的是私有协议ID空间。在IEEE 802.3x-1997中，IEEE 以太标准被修改为明确允许紧接着MAC地址的16位字段即可用于长度字段，也可用于类型字段。

Mac OS使用 802.2/SNAP 数据包来实现以太网上的AppleTalk V2协议包（"EhterTalk"）。

Novell raw 802.3[编辑]

Novell的"raw"802.3帧格式基于早期IEEE 802.3的工作。Novell以它作为起点来创建他自己的以太网上IPX协议的的第一个实现。他们没有使用LLC头，而是直接在长度字段后面开始IPX数据包。这不符合IEEE 802.3标准，但由于IPX的前两个字节一直是FF（而在IEEE 802.2 LLC中这种模式虽然理论上是可能的但实际上概率极其微小），实用中这种方式与其他以太实现共同存在。但须注意在一些早期的DECnet（英语：DECnet）可能无法识别之。

直到90年代中期，Novell NetWare默认使用这个帧类型，而由于Netware曾如此流行，而那时IP还不是那么流行，在过去的一些时候，大多数的以太网上都运载着负载IPX的"raw" 802.3数据包。直到Netware 4.10，当使用IPX时，Netware才默认使用IEEE 802.2和LLC（Nerware 帧类型Ethernet_802.2）。

效率[编辑]

我们可以计算以太网的效率和比特率：

Efficiency

=

Payload size

Frame size

{\displaystyle {\text{Efficiency}}={\frac {\text{Payload size}}{\text{Frame size}}}}

当达到允许的最大负载值时可达到最高效率，对于无标签的以太网数据包是

1500

1538

=

97.53

%

{\displaystyle {\frac {1500}{1538}}=97.53\%}

，而使用802.1Q VLAN标签时是

1500

1542

=

97.28

%

{\displaystyle {\frac {1500}{1542}}=97.28\%}

。

由效率中可计算比特率：

Net bit rate

=

Efficiency

×

Wire bit rate

{\displaystyle {\text{Net bit rate}}={\text{Efficiency}}\times {\text{Wire bit rate}}\,\!}

不带802.1Q标签的100BASE-TX以太网的最大比特率是97.53 Mbit/s.

注：不带标签的最大帧尺寸=1518 + 20 (7-byte 前导符,1-byte 帧开始符, 12-byte 帧间距)= 1538。

矮帧[编辑]

矮帧是一个尺寸不及IEEE 802.3定义的最小长度64字节的以太网帧。可能的原因是以太网碰撞，数据不足，网卡错误或软件错误。[4]

注释[编辑]

^ 前导码和帧开始符无法在包嗅探程序中显示。这些信息会在OSI第1层被网卡处理掉，而不会传入嗅探程序采集数据的OSI第2层。也存在OSI物理层的嗅探工具以显示这些前导码和帧开始符，但这些设备大多昂贵，多用于检测硬件相关的故障。

^ 前导码和帧开始符的位模式以位串的方式给出，最左的比特最先传输(而非以字节为单位，以太网传输最优先的位)。这个脚注与IEEE 802.3标准吻合。

^ 第一版以太帧在早期以太网原型中使用，并使用8位MAC地址，从未在商业中使用

参考资料[编辑]

^ Drew Heywood; Zubair Ahmad. Drew Heywood's Windows 2000 Network Services. Sams. 2001: 53. ISBN 0672317419. 

^ IEEE Std 802.3-2005, 3.2.6

^ RFC 1042

^ Glossary of Terms - R (Zarlink Semiconductor). [2011-03-01]. （原始内容存档于2009-10-26）.  071227 products.zarlink.com

查论编局域网技术之以太网家族速度

10Mbit/s

双绞线以太网

100Mbit/s

1Gbit/s

2.5和5Gbit/s

10Gbit/s

25和50Gbit/s（英语：25 Gigabit Ethernet）

40和100Gbit/s

200Gbit/s和400Gbit/s

常规

IEEE 802.3

以太网物理层（英语：Ethernet physical layer）

自动协商（英语：Autonegotiation）

以太网供电

以太类型

以太网联盟（英语：Ethernet Alliance）

流控制

帧

巨型帧

历史

CSMA/CD

StarLAN（英语：StarLAN）

10BROAD36（英语：10BROAD36）

10BASE-FB（英语：10BASE-FB）

10BASE-FL（英语：10BASE-FL）

10BASE5（英语：10BASE5）

10BASE2（英语：10BASE2）

100BaseVG（英语：100BaseVG）

LattisNet（英语：LattisNet）

长距离（英语：Long Reach Ethernet）

应用程序

音频（英语：Audio over Ethernet）

运营商（英语：Carrier Ethernet）

数据中心（英语：Data center bridging）

高能效以太网

第一英里（英语：Ethernet in the first mile）

10G-EPON（英语：10G-EPON）

工业以太网

以太网供电

同步（英语：Synchronous Ethernet）

收发器

MAU（英语：Medium Attachment Unit）

GBIC

SFP

XENPAK

X2

XFP

SFP+

QSFP（英语：QSFP）

CFP（英语：C Form-factor Pluggable）

接口

AUI（英语：Attachment Unit Interface）

MDI

MII

GMII

XGMII

XAUI

分类

维基共享

取自“https://zh.wikipedia.org/w/index.php?title=以太网帧格式&oldid=73376925”

分类：​以太网路隐藏分类：​使用RFC魔术链接的页面自2019年8月需要从英语维基百科翻译的条目需要从英语维基百科翻译的条目自2019年8月需补充来源的条目拒绝当选首页新条目推荐栏目的条目

本页面最后修订于2022年8月26日 (星期五) 04:35。

本站的全部文字在知识共享 署名-相同方式共享 4.0协议之条款下提供，附加条款亦可能应用。（请参阅使用条款）

Wikipedia®和维基百科标志是维基媒体基金会的注册商标；维基™是维基媒体基金会的商标。

维基媒体基金会是按美国国内税收法501(c)(3)登记的非营利慈善机构。

隐私政策

关于维基百科

免责声明

行为准则

开发者

统计

Cookie声明

手机版视图

开关有限宽度模式

车小胖谈网络：Ethernet Frame - 知乎

车小胖谈网络：Ethernet Frame - 知乎切换模式写文章登录/注册车小胖谈网络：Ethernet Frame车小胖​网络安全等 2 个话题下的优秀答主以前工作期间，大型的运营商客户经常有很多case，问题都和MTU有关，做三个项目里有两个就会和MTU有关。一直有个疑问，为什么MTU会那么容易引起问题？为什么没有引起足够的重视？

经研究发现，网络设计为了更加灵活而采用了各种隧道技术，加上了各种各样的头部封装，让原来可以正常通行的IP

packet，因为加上新的头部信息臃肿（变长）而无法正常通行，需要做瘦身手术（分片），这个过程我们称之为IP

Fragment，到达目的地再把这些IP

fragmented packet重组成一个完整IP

packet，这个过程我们称之为重组IP

Reassemble。让我们来罗列一下有哪些协议让包变长：PPPoE， 802.1q，QinQ ，

MPLS， L2TP， GRE，IP

Security，OTV

，VxLAN等，对于这些协议先不展开，先来了解一些影响MTU的因素。以太网帧：Ethernet Frame标准的以太网帧，我们经常说的以太网帧长度是从图中

Destination MAC开始，FCS结束。网卡对网络层数据的操作是加以太网帧头、以太网帧尾FCS，很显然上层需要提供目的MAC地址，否则接口无从完成以太网帧的封装。这需要IP层需要事先完成和ARP的交互，解析出目的IP对应的目的MAC，这显然不能由网卡来完成。网卡对物理层接收到的二进制流成帧处理，校验FCS，去掉以太网帧头，把载荷Payload

放在接收缓存，等待网络层取走。标准的以太网帧最大可以发送长度1518字节，指的就是这个。去掉以太网头14个字节，再去掉尾部的校验和FCS

4个字节，留给上层协议也就是(1518-14-4)=1500个字节，这个就是MTU的由来。上层协议加黑的原因是要引起大家的注意，这个上层协议如果是IP，那么就是IP

MTU，如果是MPLS，就是MPLS MTU，如果是IPv6，那就是IPv6

MTU。Ether

Type: 以太网协议网卡用来分辨封装的是什么协议，然后再通知不同的协议模块来取走数据。Payload:

载荷这个允许负荷的最大长度对应的就是负荷的最大传输单元，即MTU，标准的以太网帧，允许的最大负荷长度为1500字节，所以如果上层协议为IPv4，那就是IPv4

MTU=1500，所以经常看到主机的MTU为1500字节。FCS:

校验码为了防止在传输过程中发生错误，数据发送方的网卡会计算一个校验码，覆盖整个以太网帧，并放在以太网帧尾部，发送出去，接收网卡需要对其进行校验，来决定是否接收。而如果不校验，一个错误的帧可能要到TCP、UDP才能被发现出来，这样的话会浪费很多CPU资源。CPU会说：屁大点的事都搞不定，还要劳烦朕，可以去自宫了。而如果网卡来进行校验，错了就默默地丢弃，不惊动高层，高层肯定偷偷乐开了花。IP层能发现IP包的损坏吗？IP头的校验码只覆盖IP头，保证关键信息如目的IP在传输过程没有差错，可以到达目的地，至于里面封装内容则由目的地主机负责校验，可以减少路由器的处理时间，提高转发效率。以太网帧长度上下限标准以太网帧长度下限为：64

字节标准以太网帧长度上限为：1518

字节最早的以太网工作方式：载波多路复用/冲突检测CSMA/CD，因为网络是共享的，即任何一个节点发送数据之前，先要侦听线路上是否有数据在传输，如果有，需要等待，如果线路可用，才可以发送。假设A发出第一个bit位，到达B，而B也正在传输第一个bit位，于是产生冲突，冲突信号得让A在完成最后一个bit位之前到达A，这个一来一回的时间间隙slot

time是57.6μs.在10Mbps的网络中，在57.6μs的时间内，能够传输576个bit，所以要求以太网帧最小长度为576个bits，从而让最极端的碰撞都能够被检测到。这个576bit换算一下就是72个字节，去掉8个字节的前导符和帧开始符，以太网帧的最小长度为64字节。如果说以太网帧的最小长度64byte是由CSMA/CD限制所致，那最大长度1500byte又是处于什么考虑的呢？IP头total

length为两个byte，理论上IP

packet可以有65535

byte，加上Ethernet

Frame头和尾，可以有65535

+14 + 4 = 65553 byte。如果在10Mbps以太网上，将会占用共享链路长达50ms,这将严重影响其它主机的通信，特别是对延迟敏感的应用是无法接受的。由于线路质量差而引起的丢包，发生在大包的概率也比小包概率大得多，所以大包在丢包率较高的线路上不是一个好的选择。但是如果选择一个比较小的长度，传输效率又不高，拿TCP应用来说，如果选择以太网长度为218byte，TCP

payload = 218 - Ethernet Header -IP Header - TCP Header=218-18 - 20 -20= 160

byte那有效传输效率=160/218=

73%而如果以太网长度为1518，那有效传输效率=1460/1518=96%通过比较，选择较大的帧长度，有效传输效率更高，而更大的帧长度同时也会造成上述的问题，于是最终选择一个折衷的长度：1518

byte ! 对应的IP

packet 就是

1500 byte，这就是最大传输单元MTU的由来。Jumbo

Frame最早的以太网是通过Hub或集线器来工作的，在任意时刻只能有一台主机发送，这种共享方式发送效率很低，而现代高速交换机则让每个连接交换机的主机工作在独占模式，带宽独享，可以同时收发，而且现在早已不是早期的10Mbps的带宽，而是1000M、10000M，即使发送大包也不会影响别的主机，影响的只是交换机的接收和发送队列，既然发送大包效率要比小包效率搞，而且特定的应用也有发大包的需求，比如NFS文件系统，那为什么不把接口MTU提高一些，再高一些呢？这是一个好主意，于是网卡、交换机、路由器网络接口可以实现更大的MTU，可以达到>9000字节的大小，我们称这种远大于标准以太帧尺寸的帧为巨型帧Jumbo

Frame 。于是网络接口提供可以修改MTU的配置命令，比如缺省为1500，可以修改为1508以支持QinQ，或者1512以支持802.1q

Mpls label，这样既可以支持终端用户标准1500

字节IP

packet，又可以避免分片。有一点需要说明，二层交换机的接口，我们可以看成一块普通的网卡，网卡工作在数据链路层，所以分片不是它的职责，如果一个帧需要从交换机一个接口发送出去，而帧的长度>接口MTU，怎么办？丢弃！会发什么消息告诉源主机吧？不会的，默默地丢，当什么否没有发生，这种情况最难以排查，如果traceroute可以看到端对端使通的，而发送数据就是会失败。所以切记，一台交换机要保证接口MTU的一致性。如果在一个VLAN上、或整个交换机都采用同样的MTU，就不会发生上述情况。而如果入接口是9000字节，而出接口是1500，就会发生上述问题。如果一条物理链路的两端MTU不一致，则会发生什么情况，比如一侧是1500，一侧是9000，1500一侧发出来的数据肯定没有问题，但是如果从9000侧发给1500呢？数据也背默默地丢了。为什么呢？我们来谈另外一个很少提及的词汇：MRU，最大接收单元。最大接收单元MRU我们一直谈的最大传输单元MTU是关于出方向的流量处理，而MRU恰恰相反，是关于入方向的流量处理。一般情况下MTU

= MRU，比如9000侧的数据到达1500，由于9000>MRU

，所以直接默默丢弃。所以在配置链路时，要确保两侧的设备MTU要匹配，无论各家厂商对MTU理解如何、实现如何，一定要保证两端匹配，即各自允许在以太网线上发送、接收的数据流，即以太网帧的最大长度一样！编辑于 2017-03-23 09:12IP网络Ethernet​赞同 195​​38 条评论​分享​喜欢​收藏​申请

以太网帧格式_百度百科

格式_百度百科 网页新闻贴吧知道网盘图片视频地图文库资讯采购百科百度首页登录注册进入词条全站搜索帮助首页秒懂百科特色百科知识专题加入百科百科团队权威合作下载百科APP个人中心以太网帧格式播报讨论上传视频计算机原始格式收藏查看我的收藏0有用+10本词条由“科普中国”科学百科词条编写与应用工作项目 审核 。在以太网链路上的数据包称作以太帧。以太帧起始部分由前导码和帧开始符组成。后面紧跟着一个以太网报头，以MAC地址说明目的地址和源地址。帧的中部是该帧负载的包含其他协议报头的数据包(例如IP协议)。以太帧由一个32位冗余校验码结尾。它用于检验数据传输是否出现损坏。中文名以太网帧格式IEEE802.3OriginalIEEE802Revised 1997V    1原始的一种格式V2(ARPA)更改EthernetV1电气特性物理接口RAW 802.3跟正式的IEEE 802.3标准不兼容目录1简介2结构3以太帧类型4矮帧简介播报编辑在以太网链路上的数据包称作以太帧。以太帧起始部分由前导码和帧开始符组成。后面紧跟着一个以太网报头，以MAC地址说明目的地址和源地址。帧的中部是该帧负载的包含其他协议报头的数据包(例如IP协议)。以太帧由一个32位冗余校验码结尾。它用于检验数据传输是否出现损坏。 [1]结构播报编辑来自线路的二进制数据包称作一个帧。从物理线路上看到的帧，除其他信息外，还可看到前导码和帧开始符。任何物理硬件都会需要这些信息。下面的表格显示了在以1500个八比特组为MTU传输(有些吉比特以太网甚至更高速以太网支持更大的帧，称作巨型帧)时的完整帧格式。一个八比特组是八个位组成的数据(也就是现代计算机的一个字节)。ethernet || 型 以太网帧结构前导码帧开始符MAC 目标地址MAC 源地址802.1Q标签 (可选)以太类型负载冗余校验帧间距10101010 7个octet10101011 1个octet6 octets6 octets(4 octets)2 octets46–1500 octets4 octets12 octets64–1522 octets72–1530 octets84–1542 octets前导码和帧开始符参见：Syncword一个帧以7个字节的前导码和1个字节的帧开始符作为帧的开始。快速以太网之前，在线路上帧的这部分的位模式是10101010 10101010 10101010 10101010 10101010 10101010 10101010 10101011。由于在传输一个字节时最低位最先传输(LSB)，因此其相应的16进制表示为0x55 0x55 0x55 0x55 0x55 0x55 0x55 0xD5。10/100M 网卡(MIIPHY)一次传输4位(一个半字)。因此前导符会成为7组0x5+0x5,而帧开始符成为0x5+0xD。1000M网卡(GMII)一次传输8位，而10Gbit/s(XGMII) PHY芯片一次传输32位。 注意当以octet描述时，先传输7个01010101然后传输11010101。由于8位数据的低4位先发送，所以先发送帧开始符的0101，之后发送1101。报头报头包含源地址和目标地址的MAC地址，以太类型字段和可选的用于说明VLAN成员关系和传输优先级的IEEE 802.1QVLAN 标签。帧校验码帧校验码是一个32位循环冗余校验码，以便验证帧数据是否被损坏。帧间距主条目：en:Interframe gap当一个帧发送出去之后，发送方在下次发送帧之前，需要再发送至少12个octet的空闲线路状态码。 [1]以太帧类型播报编辑以太帧有很多种类型。不同类型的帧具有不同的格式和MTU值。但在同种物理媒体上都可同时存在。以太网第二版或者称之为Ethernet II 帧，DIX帧，是最常见的帧类型。并通常直接被IP协议使用。Novell的非标准IEEE 802.3帧变种。IEEE 802.2逻辑链路控制(LLC) 帧子网接入协议(SNAP)帧所有四种以太帧类型都可包含一个IEEE 802.1Q选项来确定它属于哪个VLAN以及他的IEEE 802.1p优先级(QoS)。这个封装由IEEE 802.3ac定义并将帧大小从64字节扩充到1522字节(注：不包含7个前导字节和1个字节的帧开始符以及12个帧间距字节)。IEEE 802.1Q标签，如果出现，需要放在源地址字段和以太类型或长度字段的中间。这个标签的前两个字节是标签协议标识符(TPID)值0x8100。这与没有标签帧的以太类型/长度字段的位置相同，所以以太类型0x8100就表示包含标签的帧，而实际的以太类型/长度字段则放在Q-标签的后面。TPID后面是两个字节的标签控制信息(TCI)。(IEEE 802.1p 优先级(QoS)和VLANID)。Q标签后面就是通常的帧内容。Ethernet II以太 II 帧(也称作DIX以太网，是以这个设计的主要成员，DEC,Intel和Xerox的名字命名的。),把紧接在目标和源MAC地址后面的这个两字节定义为以太网帧数据类型字段。例如，一个0x0800的以太类型说明这个帧包含的是IPv4数据报。同样的，一个0x0806的以太类型说明这个帧是一个ARP帧，0x8100说明这是一个IEEE 802.1Q帧，而0x86DD说明这是一个IPv6帧。当这个工业界的标准通过正式的IEEE标准化过程后，在802.3标准中以太类型字段变成了一个(数据)长度字段。(最初的以太包通过包括他们的帧来确定它们的长度，而不是以一个明确的数值。)但是包的接收层仍需知道如何解析包，因此标准要求将IEEE802.2头跟在长度字段后面，定义包的类型。多年之后，802.3x-1997标准，一个802.3标准的后继版本，正式允许两种类型的数据包同时存在。实际上，两种数据包都被广泛使用，而最初的以太数据包在以太局域网中被广泛应用，因为他的简便和低开销。为了允许一些使用以太II版本的数据报和一些使用802.3封装的最初版本的数据包能够在同一个以太网段使用，以太类型值必须大于等于1536(0x0600)。这个值比802.3数据包的最大长度1500byte (0x05DC)要更大。因此如果这个字段的值大于等于1536，则这个帧是以太II帧，而那个字段是类型字段。否则(小于1500而大于46字节)，他是一个IEEE 802.3帧，而那个字段是长度字段。1500～1536(不包含)的数值未定义。802.2 LLC一些协议，尤其是为OSI模型设计的，会直接在802.2 LLC层上操作。802.2 LLC层同时提供数据报和面向连接的网络服务。802.2以太网变种没有在常规网络中普遍使用。只有一些大公司的没有与IP网络融合的Netware设备。以前，很多公司Netware网络支持802.2以太网，以便支持从以太网到IEEE 802.5令牌环网或FDDI网络的透明桥接。当今最流行的数据包是以太网版本二，由基于IP协议的网络使用，将其以太类型设置为0x0800用于封装IPv4或者0x86DD来支持IPv6。还有一个英特网标准来使用LLC/SNAP报头将IPv4封装在IEEE 802.2帧中。这几乎从未在以太网中实现过。(但在FDDI以及令牌环网，IEEE 802.11和其他IEEE 802网络中使用)。如果不使用SNAP,IP传输无法封装在IEEE 802.2 LLC帧中。这是因为LLC协议中虽然有一种IP协议类型，却没有ARP。IPv6同样可使用LLC/SNAP在IEEE 802.2以太网上传播，但，如同IPv4，它也绝少被这样使用。(尽管LLC/SNAP的IPv6数据包在IEEE 802网络中被使用)。子网接入协议通过检查802.2 LLC头，可以确定他是否后继一个SNAP头。LLC头包含两个附加的8位地址字段，在OSI模型术语中称作服务访问点(SAPs)。当源和目标SAP都设置为0xAA时，就会使用SNAP服务。SNAP头允许以太类型值被任何IEEE 802协议使用，即使支持的是私有协议ID空间。在IEEE 802.3x-1997中，IEEE 以太标准被修改为明确允许紧接着MAC地址的16位字段即可用于长度字段，也可用于类型字段。Mac OS使用 802.2/SNAP 数据包来实现以太网上的AppleTalkV2协议包("EtherTalk")。Novell raw 802.3Novell的"raw"802.3帧格式基于早期IEEE 802.3的工作。Novell以它作为起点来创建他自己的以太网上IPX协议的的第一个实现。他们没有使用LLC头，而是直接在长度字段后面开始IPX数据包。这不匹配IEEE 802.3标准，但由于IPX的前两个字节一直是FF(而在IEEE 802.2 LLC中这种模式虽然理论上是可能的但实际上概率极其微小)，实用中这种方式与其他以太实现共同存在。但须注意在一些早期的DECnet可能无法识别之。直到90年代中期，Novell NetWare默认使用这个帧类型，而由于Netware曾如此流行，而那时IP还不是那么流行，在过去的一些时候，大多数的以太网上都运载着负载IPX的"raw" 802.3数据包。直到Netware 4.10，当使用IPX时，Netware才默认使用IEEE 802.2和LLC(Nerware 帧类型Ethernet_802.2)。 [1]矮帧播报编辑矮帧是一个尺寸不及IEEE 802.3定义的最小长度64字节的以太网帧。可能的原因是以太网通讯冲突，数据不足，网卡错误或软件错误。 [1]新手上路成长任务编辑入门编辑规则本人编辑我有疑问内容质疑在线客服官方贴吧意见反馈投诉建议举报不良信息未通过词条申诉投诉侵权信息封禁查询与解封©2024 Baidu 使用百度前必读 | 百科协议 | 隐私政策 | 百度百科合作平台 | 京ICP证030173号 京公网安备110000020000

21.2 二层网络 --- Ethernet - 知乎

21.2 二层网络 --- Ethernet - 知乎首发于MIT6.S081 操作系统工程中文翻译切换模式写文章登录/注册21.2 二层网络 --- Ethernet肖宏辉网络/OpenStack/SDN/NFV搬运工让我从最底层开始，我们先来看一下一个以太网packet的结构是什么。当两个主机非常靠近时，或许是通过相同的线缆连接，或许连接在同一个wifi网络，或许连接到同一个以太网交换机。当局域网中的两个主机彼此间要通信时，最底层的协议是以太网协议。你可以认为Host1通过以太网将Frame发送给Host2。Frame是以太网中用来描述packet的单词，本质上这就是两个主机在以太网上传输的一个个的数据Byte。以太网协议会在Frame中放入足够的信息让主机能够识别彼此，并且识别这是不是发送给自己的Frame。每个以太网packet在最开始都有一个Header，其中包含了3个数据。Header之后才是payload数据。Header中的3个数据是：目的以太网地址，源以太网地址，以及packet的类型。每一个以太网地址都是48bit的数字，这个数字唯一识别了一个网卡。packet的类型会告诉接收端的主机该如何处理这个packet。接收端主机侧更高层级的网络协议会按照packet的类型检查并处理以太网packet中的payload。整个以太网packet，包括了48bit+48bit的以太网地址，16bit的类型，以及任意长度的payload这些都是通过线路传输。除此之外，虽然对于软件来说是不可见的，但是在packet的开头还有被硬件识别的表明packet起始的数据（注，Preamble + SFD），在packet的结束位置还有几个bit表明packet的结束（注，FCS）。packet的开头和结束的标志不会被系统内核所看到，其他的部分会从网卡送到系统内核。如果你们查看了这门课程的最后一个lab，你们可以发现我们提供的代码里面包括了一些新的文件，其中包括了kernel/net.h，这个文件中包含了大量不同网络协议的packet header的定义。上图中的代码包含了以太网协议的定义。我们提供的代码使用了这里结构体的定义来解析收到的以太网packet，进而获得目的地址和类型值（注，实际中只需要对收到的raw data指针强制类型转换成结构体指针就可以完成解析）。学生提问：硬件用来识别以太网packet的开头和结束的标志是不是类似于lab中的End of Packets？Robert教授：并不是的，EOP是帮助驱动和网卡之间通信的机制。这里的开头和结束的标志是在线缆中传输的电信号或者光信号，这些标志位通常在一个packet中是不可能出现的。以结束的FCS为例，它的值通常是packet header和payload的校验和，可以用来判断packet是否合法。有关以太网48bit地址，是为了给每一个制造出来的网卡分配一个唯一的ID，所以这里有大量的可用数字。这里48bit地址中，前24bit表示的是制造商，每个网卡制造商都有自己唯一的编号，并且会出现在前24bit中。后24bit是由网卡制造商提供的任意唯一数字，通常网卡制造商是递增的分配数字。所以，如果你从一个网卡制造商买了一批网卡，每个网卡都会被写入属于自己的地址，并且如果你查看这些地址，你可以发现，这批网卡的高24bit是一样的，而低24bit极有可能是一些连续的数字。虽然以太网地址是唯一的，但是出了局域网，它们对于定位目的主机的位置是没有帮助的。如果网络通信的目的主机在同一个局域网，那么目的主机会监听发给自己的地址的packet。但是如果网络通信发生在两个国家的主机之间，你需要使用一个不同的寻址方法，这就是IP地址的作用。在实际中，你可以使用tcpdump来查看以太网packet。这将会是lab的一部分。下图是tcpdump的一个输出：tcpdump输出了很多信息，其中包括：接收packet的时间第一行的剩下部分是可读的packet的数据接下来的3行是收到packet的16进制数如果按照前面以太网header的格式，可以发现packet中：前48bit是一个广播地址，0xffffffffffff。广播地址是指packet需要发送给局域网中的所有主机。之后的48bit是发送主机的以太网地址，我们并不能从这个地址发现什么，实际上这个地址是运行在QEMU下的XV6生成的地址，所以地址中的前24bit并不是网卡制造商的编号，而是QEMU编造的地址。接下来的16bit是以太网packet的类型，这里的类型是0x0806，对应的协议是ARP。剩下的部分是ARP packet的payload。发布于 2021-04-24 19:21网络协议以太网（Ethernet）MIT 公开课程​赞同 4​​添加评论​分享​喜欢​收藏​申请转载​文章被以下专栏收录MIT6.S081 操作系统工程中文翻译争取两周更新一个lect

Ethernet - Wireshark Wiki

Ethernet - Wireshark Wiki

Ethernet

Ethernet (IEEE 802.3)

Ethernet (IEEE 802.3)

Overview

Packet format

Allowed Packet Lengths

MAC address fields

Type / Length field

Frame Check Sequence (FCS) field

History

Protocol dependencies

Example traffic

Example capture file

Wireshark

Preference Settings

Display Filter

Capture Filter

External links

Discussion

Overview

Ethernet is the most common local area networking technology, and, with gigabit and 10 gigabit Ethernet, is also being used for metropolitan-area and wide-area networking.

It is specified by various IEEE 802.3 specifications.

Ethernet sends network packets from the sending host to one (Unicast) or more (Multicast/Broadcast) receiving hosts.

You can find hardware related Ethernet information at the EthernetHardware page.

Information how to capture on an Ethernet network can be found at the CaptureSetup/Ethernet page.

Packet format

A physical Ethernet packet will look like this:

Preamble

Destination MAC address

Source MAC address

Type/Length

User Data

Frame Check Sequence (FCS)

8

6

6

2

46 - 1500

4

As the Ethernet hardware filters the preamble, it is not given to Wireshark or any other application. Most Ethernet interfaces also either don't supply the FCS to Wireshark or other applications, or aren't configured by their driver to do so; therefore, Wireshark will typically only be given the green fields, although on some platforms, with some interfaces, the FCS will be supplied on incoming packets.

Allowed Packet Lengths

Ethernet packets with less than the minimum 64 bytes for an Ethernet packet (header + user data + FCS) are padded to 64 bytes, which means that if there's less than 64-(14+4) = 46 bytes of user data, extra padding data is added to the packet.

Beware: the minimum Ethernet packet size is commonly mentioned at 64 bytes, which is including the FCS. This can be confusing as the FCS is often not shown by Wireshark, simply because the underlying mechanisms simply don't supply it. (XXX - add a list of system that supply the FCS and the systems that don't?)

XXX - 1GBit (10GBit?) Ethernet allows "Jumbo Ethernet Frames" of 9000? bytes, making the above standard Ethernet graphic inappropriate.

For operating system developers: it's considered to be a security threat to send uninitialised padding data!

For protocol developers: If the upper layer protocol implementation has to know exactly how much user data is in the packet, and expects the length of the Ethernet packet to indicate the amount of user data, it will not behave correctly with padded packets!

Even if the VLAN tag is 4 bytes, the minimum size of the Ethernet frame with VLAN tagging is 64 bytes.

MAC address fields

An Ethernet host is addressed by its Ethernet MAC address, a 6 byte number usually displayed as: 08:00:08:15:ca:fe (the delimiters vary, so you might see 08-00-08-15-ca-fe or the like).

The first three bytes of the address are assigned to a specific vendor or organization; they're referred to as an Organizationally Unique Identifier, or an OUI. See the IEEE OUI list, Ethernet numbers at the IANA, Michael A. Patton's list of vendor codes, and Wireshark's list of Ethernet vendor codes and well-known MAC addresses, from the Wireshark source distribution, for assigned OUIs. You can also search for a particular OUI from the IEEE OUI and Company_id Assignments page.

A destination MAC address of ff:ff:ff:ff:ff:ff indicates a Broadcast, meaning the packet is sent from one host to any other on that network.

A destination MAC address where the low-order bit of the first byte is set indicates a Multicast, meaning the packet is sent from one host to all hosts on the network interested in packets sent to that MAC address. A number of multicast addresses have been assigned; see Ethernet numbers at the IANA, Michael A. Patton's list of multicast addresses, and Wireshark's list of Ethernet vendor codes and well-known MAC addresses, from the Wireshark source distribution, for assigned multicast addresses.

The second least significant bit of the first byte is the "Locally Administrated" bit. This bit is always set to 0 for all assigned OIDs. The purpose of this bit is that if you change your MAC address you should also set this bit to 1 in the new MAC address so that it is clear it is not a factory default MAC address. Many, but not all, cluster configurations that utilize MAC address failover will set this bit to 1 for the failover interface.

Type / Length field

The original DEC/Intel/Xerox Ethernet specification included a 16-bit type field to indicate what upper layer protocol should be used.

When constructing standards for LANs, the IEEE added a new header, the 802.2 LLC header, to packets in those LANs. It contained a destination "service access point", source "service access point", and packet type field, similar to the packet type field used in HDLC and HDLC-derived protocols such as X.25's LAPB; the destination service access point indicated the service to which the packet should be delivered, where a "service" is implemented as a protocol. (XXX - is the notion of service and protocol formalized in the OSI reference model? If so, we should perhaps have a page for the OSI model and describe that notion, and link to it.) I.e., it indicates the upper layer protocol that should be used.

This meant that the type field in Ethernet could be used for other purposes, if an 802.2 header appeared at the beginning of the user data, so the IEEE standard for Ethernet, IEEE 802.3, included after the source MAC address a 16-bit field indicating the length of the user data in the packet, for the benefit of protocols that couldn't infer the length of the user data from the length of the packet as received.

However, that standard also had to support the traditional use of that field as a type field. Ethernet packets could have no more than 1500 bytes of user data, so the field is interpreted as a length field if it has a value <= 1500 and a type field if it has a value > 1500. (According to the October 1988 issue of COURIER (page 8), "if it is less than 600H, the packet is assumed to be an 802.3 packet; if it is greater than 600H, the packet is flagged as an Ethernet packet.")

Therefore, if the type/length field has a value 1500 or lower, it's a length field, and is followed by an 802.2 header, otherwise it's a type field and is followed by the data for the upper layer protocol (XXX - slight duplicate of sentence above?). Note that when the length/type field is used as a length field the length value specified does not include the length of any padding bytes (e.g. if a raw ethernet frame was sent with a payload containing a single byte of data the length field would be set to 0x0001 and 45 padding bytes would be appended to the data field to bring the ethernet frame up to the required minimum 64-byte length).

For a more detailed discussion of this, which mentions a third possibility used by NetWare, and mentions the SNAP header that can follow the 802.2 header, see Ethernet Frame Types: Provan's Definitive Answer, by Don Provan.

(XXX - we should mentioned that the 802.2/802.3 terminology used by Netware at that time is simply confusing)

Some examples of values in the type/length field:

0 - 1500 length field (IEEE 802.3 and/or 802.2)

0x0800 IP(v4), Internet Protocol version 4

0x0806 ARP, Address Resolution Protocol

0x8137 IPX, Internet Packet eXchange (Novell)

0x86dd IPv6, Internet Protocol version 6

See Ethernet numbers at the IANA, Michael A. Patton's list of Ethernet type codes, and the IEEE's list of public Ethernet type assignments for lists of some assigned Ethernet type codes. You can also search for a particular Ethernet type from the IEEE EtherType Registration Authority page; enter the Ethernet type in hex, without a leading 0x. (Not all assigned Ethernet type codes are reported publicly.)

Frame Check Sequence (FCS) field

Ethernet uses a CyclicRedundancyCheck (CRC) algorithm to detect transmission errors. The FrameCheckSequence field is filled (using a CRC) by the sending host. If the receiving host detects a wrong CRC, it will throw away that packet.

History

See Wikipedia for a brief history of Ethernet

Protocol dependencies

Ethernet is the lowest software layer, so it only depends on hardware.

Example traffic

Small portion of the capture from opening wireshark.org in a web browser.

No. Time Source Destination Protocol Info

1 0.000000 192.168.2.3 mail.packet0.com TCP 1061 > http [SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1460

2 0.063590 mail.packet0.com 192.168.2.3 TCP http > 1061 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1380

3 0.063665 192.168.2.3 mail.packet0.com TCP 1061 > http [ACK] Seq=1 Ack=1 Win=16560 Len=0

4 0.064056 192.168.2.3 mail.packet0.com HTTP GET / HTTP/1.1

5 0.163470 mail.packet0.com 192.168.2.3 TCP http > 1061 [ACK] Seq=1 Ack=399 Win=6432 Len=0

6 0.193849 mail.packet0.com 192.168.2.3 HTTP HTTP/1.1 200 OK (text/html)

7 0.201317 mail.packet0.com 192.168.2.3 HTTP Continuation

8 0.201408 192.168.2.3 mail.packet0.com TCP 1061 > http [ACK] Seq=399 Ack=2761 Win=16560 Len=0

9 0.208895 192.168.2.3 mail.packet0.com TCP 1062 > http [SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1460

10 0.280617 mail.packet0.com 192.168.2.3 HTTP Continuation

11 0.287876 mail.packet0.com 192.168.2.3 HTTP Continuation

Example capture file

Full capture from above example. Opening www.wireshark.org from the Firefox browser.

SampleCaptures/wireshark.org.pcap.gz

Wireshark

The Ethernet dissector is fully functional. Registered dissectors in packet-eth.c:

eth_withoutfcs

eth_withfcs

eth_maybefcs

Preference Settings

(XXX add links to preference settings affecting how Ethernet is dissected).

Display Filter

A complete list of Ethernet display filter fields can be found in the display filter reference

Some useful filters:

Filter

Traffic Description

eth 

all Ethernet based

eth.addr==08.00.08.15.ca.fe 

to and from Ethernet MAC address 08:00:08:15:ca:fe

!(eth.addr==08.00.08.15.ca.fe) 

all except to and from Ethernet MAC address 08:00:08:15:ca:fe

eth.dst==ff:ff:ff:ff:ff:ff 

Ethernet Broadcast only

eth.dst!=ff:ff:ff:ff:ff:ff 

all except Ethernet Broadcast

(eth.dst[0] & 1) 

Ethernet Multicast only (least significant bit of first address byte set)

!(eth.dst[0] & 1) 

all except Ethernet Multicast (least significant bit of first address byte not set)

Note: the Ethernet Broadcast address (ff:ff:ff:ff:ff:ff) is per definition a Multicast one (least significant bit of first address byte set). If you want to see only Multicasts, you have to filter out the Broadcasts as well  (eth.dst[0] & 1) && eth.dst!=ff:ff:ff:ff:ff:ff .

Capture Filter

Capture only the Ethernet-based traffic to and from Ethernet MAC address 08:00:08:15:ca:fe:

ether host 08:00:08:15:ca:fe

Ethernet Multicast traffic only:

ether multicast

Ethernet Broadcast traffic only:

ether broadcast

Ethernet traffic to/from a range of addresses:

(ether[0:4]>=0x00804400 and ether[0:4]<=0x008044ff) or (ether[6:4]>=0x00804400 and ether[6:4]<=0x008044ff)

Information how to capture on an Ethernet network can be found at the CaptureSetup/Ethernet page.

External links

A lot of tutorial information about Ethernet can be found at Charles Spurgeon's Ethernet Web Site

Xerox Wire Functional Specification - Ethernet version "0"

The Ethernet - A Local Area Network - Data Link Layer and Physical Layer Specifications - Ethernet Version 1 A.K.A. "The Blue Book"

The Ethernet - A Local Area Network - Data Link Layer and Physical Layer Specifications - Ethernet Version 1 A.K.A. "The Blue Book"

The Ethernet - A Local Area Network - Data Link Layer and Physical Layer Specifications - Ethernet Version 1 A.K.A. "The Blue Book"

The Ethernet - A Local Area Network - Data Link Layer and Physical Layer Specifications - Ethernet Version 1 A.K.A. "The Blue Book" (this version's first page shows the blue cover)

The Ethernet -- A Local Area Network -- Data Link Layer and Physical Layer Specifications, Version 2.0 (Digital, Intel, and Xerox) - (33MB PDF!)

The Ethernet -- A Local Area Network -- Data Link Layer and Physical Layer Specifications, Version 2.0 (Digital, Intel, and Xerox)

The Ethernet -- A Local Area Network -- Data Link Layer and Physical Layer Specifications, Version 2.0 (Digital, Intel, and Xerox)

Photo of a good condition copy of "The Ethernet -- A Local Area Network -- Data Link Layer and Physical Layer Specifications, Version 2.0 (Digital, Intel, and Xerox)"

48-bit Absolute Internet and Ethernet Host Numbers - origins of 48 bit addressing

Ethernet History - a website dedicated to the 30th anniversary of Ethernet, created by Yogan Dalal, one of the early people involved with it (and co-author of the "48-bit Absolute Internet and Ethernet Host Numbers" paper above)

Discussion

Maybe we should add dissection of the MAC address and the Multicast and the LocallyAdministrated bits. Since many clusters implement MAC failover and they create the "new" MAC address for the failover interface as the same MAC address as the primary interface but with the LA bit set to 1, we should also add code to strip this bit off when we try to map it to a OID name.

Imported from https://wiki.wireshark.org/Ethernet on 2020-08-11 23:13:51 UTC

Wireshark Wiki

•

Page history

2   Ethernet Basics — An Introduction to Computer Networks, desktop edition 2.0.11

2   Ethernet Basics — An Introduction to Computer Networks, desktop edition 2.0.11

Navigation

index

next |

previous |

An Introduction to Computer Networks, desktop edition 2.0.11 »

Table of Contents

2   Ethernet Basics

2.1   10-Mbps Classic Ethernet

2.1.1   Ethernet Packet Format

2.1.2   Ethernet Multicast

2.1.3   Ethernet Address Internal Structure

2.1.4   The LAN Layer

2.1.5   The Slot Time and Collisions

2.1.6   Exponential Backoff Algorithm

2.1.7   Capture effect

2.1.8   Hubs and topology

2.1.9   Errors

2.1.10   CSMA persistence

2.1.11   Analysis of Classic Ethernet

2.1.11.1   The ALOHA models

2.1.11.2   ALOHA and Ethernet

2.2   100 Mbps (Fast) Ethernet

2.3   Gigabit Ethernet

2.4   Ethernet Switches

2.4.1   Ethernet Learning Algorithm

2.5   Epilog

2.6   Exercises

Previous topic

1   An Overview of Networks

Next topic

3   Advanced Ethernet

Quick search

2   Ethernet Basics¶

We now turn to a deeper analysis of the ubiquitous Ethernet LAN protocol. In this chapter we cover the more universal Ethernet concepts, such as would be encountered in any residential or small-office Ethernet setting and including switching and learning. The following chapter covers more advanced features, such as the spanning-tree algorithm, virtual LANs, Ethernet hardware, TRILL/SPB and software-defined networking.

Current user-level Ethernet today (2020) is usually 100 Mbps or Gigabit, with Gigabit and 10 Gigabit Ethernet standard in server rooms and backbones. However, because the potential for packet collisions makes Ethernet speeds scale in odd ways, we will start with the 10 Mbps formulation. While the 10 Mbps speed is obsolete, and while even the Ethernet collision mechanism is largely obsolete, collision management itself continues to play a significant role in wireless networks.

The original Ethernet specification was the 1976 paper of Metcalfe and Boggs, [MB76]. The data rate was 10 megabits per second, and all connections were made with coaxial cable instead of today’s twisted pair. The authors described their passive architecture as follows:

We cannot afford the redundant connections and dynamic routing of store-and-forward packet switching to assure reliable communication, so we choose to achieve reliability through simplicity. We choose to make the shared communication facility passive so that the failure of an active element will tend to affect the communications of only a single station.

Classic Ethernet was indeed simple, and – mostly – passive. In its most basic form, the Ethernet medium was one long piece of coaxial cable, onto which stations could be connected via taps. If two stations happened to transmit at the same time – most likely because they were both waiting for a third station to finish – their signals were lost to the resultant collision. The only active components besides the stations were repeaters, originally intended simply to make end-to-end joins between cable segments.

Repeaters soon evolved into multiport devices, allowing the creation of arbitrary tree (that is, loop-free) topologies. At this point the standard wiring model shifted from one long cable, snaking from host to host, to a “star” network, where each host connected directly to a central multipoint repeater. This shift allowed for the replacement of expensive coaxial cable by the much-cheaper twisted pair; links could not be as long, but they did not need to be.

Repeaters, which forwarded collisions, soon gave way to switches, which did not (2.4   Ethernet Switches). Switches thus partitioned an Ethernet into disjoint collision domains, or physical Ethernets, through which collisions could propagate; an aggregation of physical Ethernets connected by switches was then sometimes known as a virtual Ethernet. Collision domains became smaller and smaller, eventually down to individual links and then vanishing entirely.

Throughout all these early changes, Ethernet never implemented true redundant connections, in that at any one instant the topology was always required to be loop-free. However, by 1985 Ethernet did adopt a mechanism by which idle backup links can quickly be placed into service after a primary link fails; 3.1   Spanning Tree Algorithm and Redundancy. Finally, in the early part of this century, support for redundant connections (and looping topologies) arrived in the form of TRILL and SPB (3.3   TRILL and SPB).

2.1   10-Mbps Classic Ethernet¶

Originally, Ethernet consisted of a long piece of cable (possibly spliced by repeaters). When a station transmitted, the data went everywhere along that cable. Such an arrangement is known as a broadcast bus; all packets were, at least at the physical layer, broadcast onto the shared medium and could be seen, theoretically, by all other nodes. Logically, however, most packets would appear to be transmitted point-to-point, not broadcast. This was because between each station CPU and the cable there was a peripheral device (that is, a card) known as a network interface, which would take care of the details of transmitting and receiving. The network interface would (and still does) decide when a received packet should be forwarded to the host, via a CPU interrupt.

Fig. 8: Hosts and cable, with network interfaces in between

Whenever two stations transmitted at the same time, the signals would collide, and interfere with one another; both transmissions would fail as a result. Proper handling of collisions was an essential part of the access-mediation strategy for the shared medium. In order to minimize collision loss, each station implemented the following:

Before transmission, wait for the line to become quiet

While transmitting, continually monitor the line for signs that a collision has occurred; if a collision is detected, cease transmitting

If a collision occurs, use a backoff-and-retransmit strategy

These properties can be summarized with the CSMA/CD acronym: Carrier

Sense, Multiple Access, Collision Detect. (The term “carrier sense” was used by Metcalfe and Boggs as a synonym for “signal sense”; there is no literal carrier frequency to be sensed.) It should be emphasized that collisions are a normal event in Ethernet, well-handled by the mechanisms above.

IEEE 802 Network Standards

The IEEE network standards all begin with 802: 802.3 is Ethernet, 802.11 is Wi-Fi, 802.16 is WiMAX, and there are many others. One sometimes encounters the claim that 802 represents the date of an early meeting: February 1980. However, the IEEE has a continuous stream of standards (with occasional gaps): 799: Handling and Disposal of Transformer PCBs, 800: D-C Aircraft Rotating Machines, 803: Recommended Practice for Unique Identification in Power Plants, etc.

Classic Ethernet came in version 1 [1980, DEC-Intel-Xerox], version 2 [1982, DIX], and IEEE 802.3. There are some minor electrical differences between these, and one rather substantial packet-format difference, below. In addition to these, the Berkeley Unix trailing-headers packet format was used for a while.

There were three physical formats for 10 Mbps Ethernet cable: thick coax (10BASE-5), thin coax (10BASE-2), and, last to arrive, twisted pair (10BASE-T). Thick coax was the original; economics drove the successive development of the later two. The cheaper twisted-pair cabling eventually almost entirely displaced coax, at least for host connections.

The original specification included support for repeaters, which were in effect signal amplifiers although they might attempt to clean up a noisy signal. Repeaters processed each bit individually and did no buffering. In the telecom world, a repeater might be called a digital regenerator. A repeater with more than two ports was commonly called a hub; hubs allowed branching and thus much more complex topologies.

It was the rise of hubs that enabled star topologies in which each host connects directly to the hub rather than to one long run of coax. This in turn enabled twisted-pair cable: while this supported maximum runs of about 100 meters, versus the 500 meters of thick coax, each run simply had to go from the host to the central hub in the wiring closet. This was much more convenient than having to snake coax all around the building. A hub failure would bring the network down, but hubs proved largely reliable.

Bridges – later known as switches – came along a short time later. While repeaters act at the bit layer, a switch reads in and forwards an entire packet as a unit, and the destination address is consulted to determine to where the packet is forwarded. Except for possible collision-related performance issues, hubs and switches are interchangeable. Eventually, most wiring-closet hubs were replaced with switches.

Hubs propagate collisions; switches do not. If the signal representing a collision were to arrive at one port of a hub, it would, like any other signal, be retransmitted out all other ports. If a switch were to detect a collision on one port, no other ports would be involved; only packets received successfully are ever retransmitted out other ports.

Originally, switches were seen as providing interconnection (“bridging”) between separate physical Ethernets; a switch for such a purpose needed just two ports. Later, a switched Ethernet was seen as one large “virtual” Ethernet, composed of smaller collision domains. Although the term “switch” is now much more common than “bridge”, the latter is still in use, particularly by the IEEE. For some, a switch is a bridge with more than two ports, though that distinction is relatively meaningless as it has been years since two-port bridges were last manufactured. We return to switching below in 2.4   Ethernet Switches.

In the original thick-coax cabling, connections were made via taps, often literally drilled into the coax central conductor. Thin coax allowed the use of T-connectors to attach hosts. Twisted-pair does not allow mid-cable attachment; it is only used for point-to-point links between hosts, switches and hubs. Mid-cable attachment, however, was always simply a way of avoiding the need for active devices like hubs and switches.

There is still a role for hubs today when one wants to monitor the Ethernet signal from A to B (eg for intrusion detection analysis), although some switches now also support a form of monitoring.

All three cable formats could interconnect, although only through repeaters and hubs, and all used the same 10 Mbps transmission speed. While twisted-pair cable is still used by 100 Mbps Ethernet, it generally needs to be a higher-performance version known as Category 5, versus the 10 Mbps Category 3.

Data in 10 Mbps Ethernets was transmitted using Manchester encoding; see 6.1.3   Manchester. This meant that the electronics had to operate, in effect, at 20 Mbps. Faster Ethernets use different encodings.

2.1.1   Ethernet Packet Format¶

Here is the format of a typical Ethernet packet (DIX specification); it is still used for newer, faster Ethernets:

Fig. 9: Ethernet packet with header fields

The destination and source addresses are 48-bit quantities; the type is 16 bits, the data length is variable up to a maximum of 1500 bytes, and the final CRC checksum is 32 bits. The checksum is added by the Ethernet hardware, never by the host software. There is also a preamble, not shown: a block of 1 bits followed by a 0, in the front of the packet, for synchronization. The type field identifies the next higher protocol layer; a few common type values are 0x0800 = IP, 0x8137 = IPX, 0x0806 = ARP.

The IEEE 802.3 specification replaced the type field by the length field, though this change never caught on. The two formats can be distinguished as long as the type values used are larger than the maximum Ethernet length of 1500 (or 0x05dc); the type values given in the previous paragraph all meet this condition.

The Ethernet maximum packet length of 1500 bytes worked well in the past, but can seem inconveniently small at 10 Gbit speeds. But 1500 bytes has become the de facto maximum packet size throughout the Internet, not just on Ethernet LANs; increasing it would be difficult. TCP TSO (17.5   TCP Offloading) is one alternative.

Each Ethernet card has a (hopefully unique) physical address in ROM; by default any packet sent to this address will be received by the board and passed up to the host system. Packets addressed to other physical addresses will be seen by the card, but ignored (by default). All Ethernet devices also agree on a broadcast address of all 1’s: a packet sent to the broadcast address will be delivered to all attached hosts.

It is sometimes possible to change the physical address of a given card in software. It is almost universally possible to put a given card into promiscuous mode, meaning that all packets on the network, no matter what the destination address, are delivered to the attached host. This mode was originally intended for diagnostic purposes but became best known for the security breach it opens: it was once not unusual to find a host with network board in promiscuous mode and with a process collecting the first 100 bytes (presumably including userid and password) of every telnet connection.

2.1.2   Ethernet Multicast¶

Another category of Ethernet addresses is multicast, used to transmit to a set of stations; streaming video to multiple simultaneous viewers might use Ethernet multicast.

The lowest-order bit in the first byte of an address indicates whether the address is

physical or multicast. To receive packets addressed to a given multicast address, the host must inform its network interface that it wishes to do so; once this is done, any arriving packets addressed to that multicast address are forwarded to the host. The set of subscribers to a given multicast address may be called a multicast group. While higher-level protocols might prefer that the subscribing host also notifies some other host, eg the sender, this is not required, although that might be the easiest way to learn the multicast address involved. If several hosts subscribe to the same multicast address, then each will receive a copy of each multicast packet transmitted.

We are now able to list all cases in which a network interface forwards a received packet up to its attached host:

if the destination address of the received packet matches the physical address of the interface

if the destination address of the received packet is the broadcast address

if the interface is in promiscuous mode

if the destination address of the received packet is a multicast address and the host has told the network interface to accept packets sent to that multicast address

If switches (below) are involved, they must normally forward multicast packets on all outbound links, exactly as they do for broadcast packets; switches have no obvious way of telling where multicast subscribers might be. To avoid this, some switches do try to engage in some form of multicast filtering, sometimes by snooping on higher-layer multicast protocols. Multicast Ethernet is seldom used by IPv4, but plays a larger role in IPv6 configuration.

2.1.3   Ethernet Address Internal Structure¶

The second-to-lowest-order bit of a physical Ethernet address indicates whether that address is believed to be globally unique or if it is only locally unique; this is known as the Universal/Local bit. For real Ethernet physical addresses, the multicast and universal/local bits of the first byte should both be 0. At the physical layer, Ethernet transmits the bits of each byte from low-order to high-order (as do many other serial protocols such as HDLC (6.1.5.1   HDLC) and the ubiquitous last-century serial protocol RS-232); this means that these two flag bits are in fact the first address bits to be transmitted. It is not clear whether this was ever important.

When (global) Ethernet IDs are assigned to physical Ethernet cards by the manufacturer, the first three bytes serve to indicate the manufacturer. They are allocated by the IEEE, and are officially known as organizationally unique identifiers. These can be looked up at any of several sites on the Internet to identify the manufacturer associated with any given Ethernet address; the official IEEE site is standards.ieee.org/develop/regauth/oui/public.html (OUIs must be entered here without colons).

As long as the manufacturer involved is diligent in assigning the second three bytes, every manufacturer-provided Ethernet address should be globally unique. Lapses, however, are not unheard of.

Ethernet addresses for virtual machines must be distinct from the Ethernet address of the host system, and may be (eg with so-called “bridged” configurations) as visible on the LAN as that host system’s address. The first three bytes of virtual Ethernet addresses are often taken from the OUI assigned to the manufacturer whose card is being emulated; the last three bytes are then either set randomly or via configuration. In principle, the universal/local bit should be 1, as the address is only locally unique, but this is often ignored. It is entirely possible for virtual Ethernet addresses to be assigned so as to have some local meaning, though this appears not to be common.

2.1.4   The LAN Layer¶

The LAN layer, at its upper end, supplies to the network layer a mechanism for addressing a packet and sending it from one station to another. At its lower end, it handles interactions with the physical layer. The LAN layer covers packet addressing, delivery and receipt, forwarding, error detection, collision detection and collision-related retransmission attempts.

In IEEE protocols, the LAN layer is divided into the media access control, or MAC, sublayer and a higher logical link control, or LLC, sublayer for higher-level flow-control functions. The LLC layer is defined in IEEE standard 802.2 (versus 802.3 for the MAC layer), and is applicable to non-Ethernet LANs as well. For Ethernet, many of the LLC functions have been almost entirely supplanted by flow-control at the Transport layer (eg TCP). The LLC layer defines (but does not mandate) a form of the HDLC protocol (6.1.5.1   HDLC), which in turn supports sliding windows (8.2   Sliding Windows) as an option. The much-earlier X.25 LAN protocol also offered partial support for HDLC. Similarly, ATM, 5.5   Asynchronous Transfer Mode: ATM, supports some higher-level transport-like functions, though not sliding windows.

Because use of the LLC layer is so often insignificant, and because the most well-known LAN-layer functions are in fact part of the MAC sublayer, it is common to identify the LAN layer with its MAC sublayer, especially for IEEE protocols where the MAC layer has official standing. In particular, LAN-layer addresses are perhaps most often called MAC addresses.

Generally speaking, much of the operation of the LAN/MAC layer takes place in the network card. Host systems (including drivers) are, for example, generally oblivious to collisions (although they may query the card for collision statistics). In some cases, eg with Wi-Fi rate scaling (4.2.2   Dynamic Rate Scaling), the host-system driver may get involved.

2.1.5   The Slot Time and Collisions¶

The diameter of an Ethernet is the maximum distance between any pair of stations. The actual total length of cable can be much greater than this, if, for example, the topology is a “star” configuration. The maximum allowed diameter, measured in bits, is limited to 232 (a sample “budget” for this is below). This makes the round-trip-time 464 bits. As each station involved in a collision discovers it, it transmits a special jam signal of up to 48 bits. These 48 jam bits bring the total above to 512 bits, or 64 bytes. The time to send these 512 bits is the slot time of an Ethernet; time intervals on Ethernet are often described in bit times but in conventional time units the slot time is 51.2 µsec.

The value of the slot time determines several subsequent aspects of Ethernet. If a station has transmitted for one slot time, then no collision can occur (unless there is a hardware error) for the remainder of that packet. This is because one slot time is enough time for any other station to have realized that the first station has started transmitting, so after that time they will wait for the first station to finish. Thus, after one slot time a station is said to have acquired the network. The slot time is also used as the basic interval for retransmission scheduling, below.

Conversely, a collision can be received, in principle, at any point up until the end of the slot time. As a result, Ethernet has a minimum packet size, equal to the slot time, ie 64 bytes (or 46 bytes in the data portion).

A station transmitting a packet this size is assured that if a collision were to occur, the sender would detect it (and be able to apply the retransmission algorithm, below). Smaller packets might collide and yet the sender not know it, ultimately leading to greatly reduced throughput.

If we need to send less than 46 bytes of data (for example, a 40-byte TCP ACK packet), the Ethernet packet must be padded out to the minimum length. As a result, all protocols running on top of Ethernet need to provide some way to specify the actual data length, as it cannot be inferred from the received packet size.

As a specific example of a collision occurring as late as possible, consider the diagram below. A and B are 5 units apart, and the bandwidth is 1 byte/unit. A begins sending “helloworld” at T=0; B starts sending just as A’s message arrives, at T=5. B has listened before transmitting, but A’s signal was not yet evident. A doesn’t discover the collision until 10 units have elapsed, which is twice the distance.

Fig. 10: Ethernet collision, showing one full RTT before collision detectability

Here are typical maximum values for the delay in 10 Mbps Ethernet due to various components. These are taken from the Digital-Intel-Xerox (DIX) standard of 1982, except that “point-to-point link cable” is replaced by standard cable. The DIX specification allows 1500m of coax with two repeaters and 1000m of point-to-point cable; the table below shows 2500m of coax and four repeaters, following the later IEEE 802.3 Ethernet specification. Some of the more obscure delays have been eliminated. Entries are one-way delay times, in bits. The maximum path may have four repeaters, and ten transceivers (simple electronic devices between the coax cable and the NI cards), each with its drop cable (two transceivers per repeater, plus one at each endpoint).

Ethernet delay budget

item

length

delay, in bits

explanation (c = speed of light)

coax

2500 m

110 bits

23 meters/bit (.77c)

transceiver cables

500 m

25 bits

19.5 meters/bit (.65c)

transceivers

40 bits, max 10 units

4 bits each

repeaters

25 bits, max 4 units

6+ bits each (DIX 7.6.4.1)

encoders

20 bits, max 10 units

2 bits each (for signal generation)

The total here is 220 bits; in a full accounting it would be 232. Some of the numbers shown are a little high, but there are also signal rise time delays, sense delays, and timer delays that have been omitted. It works out fairly closely.

Implicit in the delay budget table above is the “length” of a bit. The speed of propagation in copper is about 0.77×c, where c=3×108 m/sec = 300 m/µsec is the speed of light in vacuum. So, in 0.1 microseconds (the time to send one bit at 10 Mbps), the signal propagates approximately 0.77×c×10-7 = 23 meters.

Ethernet packets also have a maximum packet size, of 1500 bytes. This

limit is primarily for the sake of fairness, so one station cannot unduly

monopolize the cable (and also so stations can reserve buffers guaranteed to hold an entire packet). At one time hardware vendors often marketed their own incompatible “extensions” to Ethernet which enlarged the maximum packet size to as much as 4 kB. There is no technical reason, actually, not to do this, except compatibility.

The signal loss in any single segment of cable is limited to 8.5 db, or about 14% of original strength. Repeaters will restore the signal to its original strength. The reason for the per-segment length restriction is that Ethernet collision detection requires a strict limit on how much the remote signal can be allowed to lose strength. It is possible for a station to detect and reliably read very weak remote signals, but not at the same time that it is transmitting locally. This is exactly what must be done, though, for collision detection to work: remote signals must arrive with sufficient strength to be heard even while the receiving station is itself transmitting. The per-segment limit, then, has nothing to do with the overall length limit; the latter is set only to ensure that a sender is guaranteed of detecting a collision, even if it sends the minimum-sized packet.

2.1.6   Exponential Backoff Algorithm¶

Whenever there is a collision the exponential backoff algorithm – operating at the MAC layer – is used to determine when each station will retry its transmission. Backoff here is called exponential because the range from which the backoff value is chosen is doubled after every successive collision involving the same packet. Here is the full Ethernet transmission algorithm, including backoff and retransmissions:

Listen before transmitting (“carrier detect”)

If line is busy, wait for sender to stop and then wait an additional 9.6 microseconds (96 bits). One consequence of this is that there is always a 96-bit gap between packets, so packets do not run together.

Transmit while simultaneously monitoring for collisions

If a collision does occur, send the jam signal, and choose a backoff time as follows: For transmission N, 1≤N≤10 (N=0 represents the original attempt), choose k randomly with 0 ≤ k < 2N. Wait k slot times (k×51.2 µsec). Then check if the line is idle, waiting if necessary for someone else to finish, and then retry step 3. For 11≤N≤15, choose k randomly with 0 ≤ k < 1024 (= 210)

If we reach N=16 (16 transmission attempts), give up.

If an Ethernet sender does not reach step 5, there is a very high probability that the packet was delivered successfully.

Exponential backoff means that if two hosts have waited for a third to finish and transmit simultaneously, and collide, then when N=1 they have a 50% chance of recollision; when N=2 there is a 25% chance, etc. When N≥10 the maximum wait is 52 milliseconds; without this cutoff the maximum wait at N=15 would be 1.5 seconds. As indicated above in the minimum-packet-size discussion, this retransmission strategy assumes that the sender is able to detect the collision while it is still sending, so it knows that the packet must be resent.

In the following diagram is an example of several stations attempting to transmit all at once, and using the above transmission/backoff algorithm to sort out who actually gets to acquire the channel. We assume we have five prospective senders A1, A2, A3, A4 and A5, all waiting for a sixth station to finish. We will assume that collision detection always takes one slot time (it will take much less for nodes closer together) and that the slot start-times for each station are synchronized; this allows us to measure time in slots. A solid arrow at the start of a slot means that sender began transmission in that slot; a red X signifies a collision. If a collision occurs, the backoff value k is shown underneath. A dashed line shows the station waiting k slots for its next attempt.

Fig. 11: Ethernet collisions with exponential backoff

At T=0 we assume the transmitting station finishes, and all the Ai transmit and collide. At T=1, then, each of the Ai has discovered the collision; each chooses a random k<2. Let us assume that A1 chooses k=1, A2 chooses k=1, A3 chooses k=0, A4 chooses k=0, and A5 chooses k=1.

Those stations choosing k=0 will retransmit immediately, at T=1. This means A3 and A4 collide again, and at T=2 they now choose random k<4. We will Assume A3 chooses k=3 and A4 chooses k=0; A3 will try again at T=2+3=5 while A4 will try again at T=2, that is, now.

At T=2, we now have the original A1, A2, and A5 transmitting for the second time, while A4 trying again for the third time. They collide. Let us suppose A1 chooses k=2, A2 chooses k=1, A5 chooses k=3, and A4 chooses k=6 (A4 is choosing k<8 at random). Their scheduled transmission attempt times are now A1 at T=3+2=5, A2 at T=4, A5 at T=6, and A4 at T=9.

At T=3, nobody attempts to transmit. But at T=4, A2 is the only station to transmit, and so successfully seizes the channel. By the time T=5 rolls around, A1 and A3 will check the channel, that is, listen first, and wait for A2 to finish. At T=9, A4 will check the channel again, and also begin waiting for A2 to finish.

A maximum of 1024 hosts is allowed on an Ethernet. This number apparently comes from the maximum range for the backoff time as 0 ≤ k < 1024. If there are 1024 hosts simultaneously trying to send, then, once the backoff range has reached k<1024 (N=10), we have a good chance that one station will succeed in seizing the channel, that is; the minimum value of all the random k’s chosen will be unique.

This backoff algorithm is not “fair”, in the sense that the longer a station has been waiting to send, the lower its priority sinks. Newly transmitting stations with N=0 need not delay at all. The Ethernet capture effect, below, illustrates this unfairness.

2.1.7   Capture effect¶

The capture effect is a scenario illustrating the potential lack of fairness in the exponential backoff algorithm. The unswitched Ethernet must be fully busy, in that each of two senders always has a packet ready to transmit.

Let A and B be two such busy nodes, simultaneously starting to transmit their first packets. They collide. Suppose A wins, and sends. When A is finished, B tries to transmit again. But A has a

second packet, and so A tries too. A chooses a backoff k<2 (that is, between 0 and 1 inclusive), but since B is on its second attempt it must choose k<4. This means A is favored to win. Suppose it does.

After that transmission is finished, A and B try yet again: A on its

first attempt for its third packet, and B on its third attempt for its first

packet. Now A again chooses k<2 but B must choose k<8; this time A is much more likely to win.

Each time B fails to win a given backoff, its probability of winning the next one is reduced by about 1/2. It is quite possible, and does occur in practice, for B to lose all the backoffs until it reaches the maximum of N=16 attempts; once it has lost the first three or four this is in fact quite likely. At this point B simply discards the packet and goes on to the next one with N reset to 1 and k chosen from {0,1}.

The capture effect can be fixed with appropriate modification of the backoff algorithm; the Binary Logarithmic Arbitration Method (BLAM) was proposed in [MM94].

The BLAM algorithm was considered for the then-nascent 100 Mbps Fast Ethernet standard. But in the end a hardware strategy won out: Fast Ethernet supports “full-duplex” mode which is collision-free (see 2.2   100 Mbps (Fast) Ethernet, below). While Fast Ethernet continues to support the original “half-duplex” mode, it was assumed that any sites concerned enough about performance to be worried about the capture effect would opt for full-duplex.

2.1.8   Hubs and topology¶

Ethernet hubs (multiport repeaters) change the topology, but not the fundamental constraints. Hubs enabled the model in which each station now had its own link to the wiring closet. Loops are still forbidden. The maximum diameter of an Ethernet consisting of multiple segments joined by hubs is still constrained by the round-trip-time, and the need to detect collisions before the sender has completed sending, as before. However, the network “diameter”, or maximum distance between two hosts, is no longer synonymous with “total length”. Because twisted-pair links are much shorter, about 100 meters, the diameter constraint is often immaterial.

2.1.9   Errors¶

Packets can have bits flipped or garbled by electrical noise on the cable; estimates of the frequency with which this occurs range from 1 in 104 to 1 in 106. Bit errors are not uniformly likely; when they occur, they are likely to occur in bursts. Packets can also be lost in hubs, although this appears less likely. Packets can be lost due to collisions only if the sending host makes 16 unsuccessful transmission attempts and gives up. Ethernet packets contain a 32-bit CRC error-detecting code (see 7.4.1   Cyclical Redundancy Check: CRC) to detect bit errors. Packets can also be misaddressed by the sending host, or, most likely of all, they can arrive at the receiving host at a point when the receiver has no free buffers and thus be dropped by a higher-layer protocol.

2.1.10   CSMA persistence¶

A carrier-sense/multiple-access transmission strategy is said to be nonpersistent if, when the line is busy, the sender waits a randomly selected time. A strategy is p-persistent if, after waiting for the line to clear, the sender sends with probability p≤1. Ethernet uses 1-persistence. A consequence of 1-persistence is that, if more than one station is waiting for line to clear, then when the line does clear a collision is certain. However, Ethernet then gracefully handles the resulting collision via the usual exponential backoff. If N stations are waiting to transmit, the time required for one station to win the backoff is linear in N.

When we consider the Wi-Fi collision-handling mechanisms in 4.2   Wi-Fi, we will see that collisions cannot be handled quite as cheaply: for one thing, there is no way to detect a collision in progress, so the entire packet-transmission time is wasted. In the Wi-Fi case, p-persistence is used with p<1.

An Ethernet broadcast storm was said to occur when there were too many transmission attempts, and most of the available bandwidth was tied up in collisions. A properly functioning classic Ethernet had an effective bandwidth of as much as 50-80% of the nominal 10Mbps capacity, but attempts to transmit more than this typically resulted in successfully transmitting a good deal less.

2.1.11   Analysis of Classic Ethernet¶

How much time does Ethernet “waste” on collisions? A paradoxical attribute of Ethernet is that raising the transmission-attempt rate on a busy segment can reduce the actual throughput. More transmission attempts can lead to longer contention intervals between packets, as senders use the transmission backoff algorithm to attempt to acquire the channel. What effective throughput can be achieved?

It is convenient to refer to the time between packet transmissions as the contention interval even if there is no actual contention, that is, even if the network is idle; we cannot tell if stations are not transmitting because they have nothing to send, or if they are simply waiting for their backoff timer to expire. Thus, a timeline for Ethernet always consists of alternating packet transmissions and contention intervals:

Fig. 12: Ethernet packet transmissions alternating with contention intervals

As a first look at contention intervals, assume that there are N stations waiting to transmit at the start of the interval. It turns out that, if all follow the exponential backoff algorithm, we can expect O(N) slot times before one station successfully acquires the channel; thus, Ethernets are happiest when N is small and there are only a few stations simultaneously transmitting. However, multiple stations are not necessarily a severe problem. Often the number of slot times needed turns out to be about N/2, and slot times are short. If N=20, then N/2 is 10 slot times, or 640 bytes. However, one packet time might be 1500 bytes. If packet intervals are 1500 bytes and contention intervals are 640 byes, this gives an overall throughput of 1500/(640+1500) = 70% of capacity. In practice, this seems to be a reasonable upper limit for the throughput of classic shared-media Ethernet.

2.1.11.1   The ALOHA models¶

Another approach to analyzing the Ethernet contention interval is by using the ALOHA model that was a precursor to Ethernet. In the ALOHA model, stations transmit packets without listening first for a quiet line or monitoring the transmission for collisions (this models the situation of several ground stations transmitting to a satellite; the ground stations are presumed unable to see one another). Similarly, during the Ethernet contention interval, stations transmit one-slot packets under what are effectively the same conditions (we return to this below).

The ALOHA model yields roughly similar throughput values to the O(N) model of the previous section. We make, however, a rather artificial assumption: that there are a very large number of active senders, each transmitting at a very low rate. The model may thus have limited direct applicability to typical Ethernets.

To model the success rate of ALOHA, assume all the packets are the same size and let T be the time to send one (fixed-size) packet; T represents the Aloha slot time. We will find the transmission rate that optimizes throughput.

The core assumption of this model is that that a large number N of hosts are transmitting, each at a relatively low rate of s packets/slot. Denote by G the average number of transmission attempts per slot; we then have G = Ns. We will derive an expression for S, the average rate of successful transmissions per slot, in terms of G.

If two packets overlap during transmissions, both are lost. Thus, a successful transmission requires everyone else quiet for an interval of 2T: if a sender succeeds in the interval from t to t+T, then no other node can have tried to begin transmission in the interval t−T to t+T. The probability of one station transmitting during an interval of time T is G = Ns; the probability of the remaining N−1 stations all quiet for an interval of 2T is (1−s)2(N−1). The probability of a successful transmission is thus

S = Ns*(1−s)2(N−1)

= G(1−G/N)2N

Math Warning

Finding the limit of G(1−G/N)2N and finding the maximum of Ge-2G realistically requires a little background in calculus. However, these are not central to applying the model.

As N gets large, the second line approaches Ge-2G.

The function S = G e-2G has a maximum at G=1/2, S=1/2e. The rate G=1/2 means that, on average, a transmission is attempted every other slot; this yields the maximum successful-transmission throughput of 1/2e. In other words, at this maximum attempt rate G=1/2, we expect about 2e−1 slot times worth of contention between successful transmissions. What happens to the remaining G−S unsuccessful attempts is not addressed by this model; presumably some higher-level mechanism (eg backoff) leads to retransmissions.

A given throughput S<1/2e may be achieved at either of two values for G; that is, a given

success rate may be due to a comparable attempt rate or else due to a very high attempt rate with a similarly high failure rate.

2.1.11.2   ALOHA and Ethernet¶

The relevance of the Aloha model to Ethernet is that during one Ethernet slot time there is no way to detect collisions (they haven’t reached the sender yet!) and so the Ethernet contention phase resembles ALOHA with an Aloha slot time T of 51.2 microseconds. Once an Ethernet sender succeeds, however, it continues with a full packet transmission, which is presumably many times longer than T.

The average length of the contention interval, at the maximum throughput calculated above, is 2e−1 slot times (from ALOHA); recall that our model here supposed many senders sending at very low individual rates. This is the minimum contention interval; with lower loads the contention interval is longer due to greater idle times and with higher loads the contention interval is longer due to more collisions.

Finally, let P be the time to send an entire packet in units of T; ie the average

packet size in units of T. P is thus the length of the “packet” phase in the diagram above. The contention phase has length 2e−1, so the total time to send one packet (contention+packet time) is 2e−1+P. The useful fraction of this is, of course, P, so the effective maximum throughput is P/(2e−1+P).

At 10Mbps, T=51.2 microseconds is 512 bits, or 64 bytes. For P=128

bytes = 2*64, the effective bandwidth becomes 2/(2e-1+2), or 31%. For

P=512 bytes=8*64, the effective bandwidth is 8/(2e+7), or 64%.

For P=1500 bytes, the model here calculates an effective bandwidth of 80%.

These numbers are quite similar to our earlier values based on a small number of stations sending constantly.

2.2   100 Mbps (Fast) Ethernet¶

Classic Ethernet, at 10 Mbps, is quite slow by modern standards, and so by 1995 the IEEE had created standards for Ethernet that operated at 100 Mbps. Ethernet at this speed is commonly known as Fast Ethernet; this name is used even today as “Fast” Ethernet is being supplanted by Gigabit Ethernet (below). By far the most popular form of 100 Mbps Ethernet is officially known as 100BASE-TX; it operates over twisted-pair cable.

In the previous analysis of 10 Mbps Ethernet, the bandwidth, minimum packet size and maximum network diameter were all interrelated, in order to ensure that collisions could always be detected by the sender. Increasing the speed means that at least one of the other constraints must be scaled as well. For example, if the network physical diameter were to remain the same when moving to 100 Mbps, then the Fast-Ethernet round-trip time would be the same in microseconds but would be 10-fold larger measured in bits; this might mean a minimum packet size of 640 bytes instead of 64 bytes. (Actually, the minimum packet size might be somewhat smaller, partly because the “jam signal” doesn’t have to become longer, and partly because some of the numbers in the 10 Mbps delay budget above were larger than necessary, but it would still be large enough that a substantial amount of bandwidth would be consumed by padding.) The designers of Fast Ethernet felt that such a large minimum-packet size was impractical.

However, Fast Ethernet was developed at a time (~1995) when reliable switches (below) were widely available; the quote above at 2   Ethernet Basics from [MB76] had become obsolete. Large “virtual” Ethernet networks could be formed by connecting small physical Ethernets with switches, effectively eliminating the need to support large-diameter physical Ethernets. So instead of increasing the minimum packet size, the decision was made to ensure collision detectability by reducing the network diameter instead. The network diameter chosen was a little over 400 meters, with reductions to account for the presence of hubs. At 2.3 meters/bit, 400 meters is 174 bits, for a round-trip of 350 bits. The slot time (and minimum packet size) remains 512 bits – now 5.12 µsec – which is safely large enough to ensure collision detection.

This 400-meter diameter, however, may be misleading: the specific 100BASE-TX standard, which uses so-called Category 5 twisted-pair cabling (or better), limits the length of any individual cable segment to 100 meters. The maximum 100BASE-TX network diameter – allowing for hubs – is just over 200 meters.

The 400-meter distance does apply to optical-fiber-based 100BASE-FX in half-duplex mode, but this is not common.

The 100BASE-TX network-diameter limit of 200 meters might seem small; it amounts in many cases to a single hub with multiple 100-meter cable segments radiating from it. In practice, however, such “star” configurations could easily be joined with switches. As we will see below in 2.4   Ethernet Switches, switches partition an Ethernet into separate “collision domains”; the network-diameter rules apply to each domain separately but not to the aggregated whole. In a fully switched (that is, no hubs) 100BASE-TX LAN, each collision domain is simply a single twisted-pair link, subject to the 100-meter maximum length.

Fast Ethernet also introduced the concept of full-duplex Ethernet: two twisted pairs could be used, one for each direction. Full-duplex Ethernet is limited to paths not involving hubs, that is, to single station-to-station links, where a station is either a host or a switch. Because such a link has only two potential senders, and each sender has its own transmit line, full-duplex Ethernet is entirely collision-free.

Fast Ethernet (at least the 100BASE-TX form) uses 4B/5B encoding, covered in 6.1.4   4B/5B. This means that the electronics have to handle 125 Mbps, versus the 200 Mbps if Manchester encoding were still used.

Fast Ethernet 100BASE-TX does not particularly support links between buildings, due to the maximum-cable-length limitation. However, fiber-optic point-to-point links are an effective alternative here, provided full-duplex is used to avoid collisions. We mentioned above that the coax-based 100BASE-FX standard allowed a maximum half-duplex run of 400 meters, but 100BASE-FX is much more likely to use full duplex, where the maximum cable length rises to 2,000 meters.

2.3   Gigabit Ethernet¶

The problem of scaling Ethernet to handle collision detection gets harder as the transmission rate increases. If we were continue to maintain the same 51.2 µsec slot time but raise the transmission rate to 1000 Mbps, the maximum network diameter would now be 20-40 meters. Instead of that, Gigabit Ethernet moved to a 4096-bit (512-byte, or 4.096 µsec) slot time, at least for the twisted-pair versions. Short frames need to be padded, but this padding is done by the hardware. Gigabit Ethernet 1000Base-T uses so-called PAM-5 encoding, below, which supports a special pad pattern (or symbol) that cannot appear in the data. The hardware pads the frame with these special patterns, and the receiver can thus infer the unpadded length as set by the host operating system.

Gigabit vs Disks

Once a network has reached Gigabit speed, the network is generally as fast as reading from or writing to a disk. Keeping data on another node no longer slows things down. This greatly expands the range of possibilities for constructing things like clustered databases.

However, the Gigabit Ethernet slot time is largely irrelevant, as full-duplex (bidirectional) operation is almost always supported. Combined with the restriction that each length of cable is a station-to-station link (that is, hubs are no longer allowed), this means that collisions simply do not occur and the network diameter is no longer a concern. (10 Gigabit Ethernet has officially abandoned any pretense of supporting collisions; everything must be full-duplex.)

There are actually multiple Gigabit Ethernet standards (as there are for Fast Ethernet). The different standards apply to different cabling situations. There are full-duplex optical-fiber formulations good for many miles (eg 1000Base-LX10), and even a version with a 25-meter maximum cable length (1000Base-CX), which would in theory make the original 512-bit slot practical.

The most common gigabit Ethernet over copper wire is 1000BASE-T (sometimes incorrectly referred to as 1000BASE-TX. While there exists a TX, it requires Category 6 cable and is thus seldom used; many devices labeled TX are in fact 1000BASE-T). For 1000BASE-T, all four twisted pairs in the cable are used. Each pair transmits at 250 Mbps, and each pair is bidirectional, thus supporting full-duplex communication. Bidirectional communication on a single wire pair takes some careful echo cancellation at each end, using a circuit known as a “hybrid” that in effect allows detection of the incoming signal by filtering out the outbound signal.

On any one cable pair, there are five signaling levels. These are used to transmit two-bit symbols at a rate of 125 symbols/µsec, for a data rate of 250 bits/µsec. Two-bit symbols in theory only require four signaling levels; the fifth symbol allows for some redundancy which is used for error detection and correction, for avoiding long runs of identical symbols, and for supporting a special pad symbol, as mentioned above. The encoding is known as 5-level pulse-amplitude modulation, or PAM-5. The target bit error rate (BER) for 1000BASE-T is 10-10, meaning that the packet error rate is less than 1 in 106.

In developing faster Ethernet speeds, economics plays at least as important a role as technology. As new speeds reach the market, the earliest adopters often must take pains to buy cards, switches and cable known to “work together”; this in effect amounts to installing a proprietary LAN. The real benefit of Ethernet, however, is arguably that it is standardized, at least eventually, and thus a site can mix and match its cards and devices. Having a given Ethernet standard support existing cable is even more important economically; the costs of replacing inter-office cable often dwarf the costs of the electronics.

As Ethernet speeds continue to climb, it has become harder and harder for host systems to keep up. As a result, it is common for quite a bit of higher-layer processing to be offloaded onto the Ethernet hardware, for example, TCP checksum calculation. See 17.5   TCP Offloading.

2.4   Ethernet Switches¶

Switches join separate physical Ethernets (or sometimes Ethernets and other kinds of networks). A switch has two or more Ethernet interfaces; when a packet is received on one interface it is retransmitted on one or more other interfaces. Only valid packets are forwarded; collisions are not propagated. The term collision domain is sometimes used to describe the region of an Ethernet in between switches; a given collision propagates only within its collision domain.

The diagram below shows some physical Ethernets joined by three switches S1, S2 and S3. Hosts A, B, C and D are on two separate traditional multiple-access Ethernets; hosts E and F have direct point-to-point links to S2 and S3 respectively. The S2–S3 link is also a point-to-point link. If A and B both transmit at the same time, or C and D, the packets collide as usual. But if A and C both transmit, then S1 receives the two packets on its two separate interfaces in parallel; they do not collide. S1 can then forward C’s packet on its lefthand interface at the same time it forwards A’s packet on its righthand interface.

Fig. 13: Ethernet with switches S1, S2 and S3

Similarly, if E and F both transmit at the same time, their packets are received by S2 and S3 respectively. In the absence of forwarding information, S2 will flood E’s packet out both its lefthand and downward interfaces in parallel, though in the next section we will see how real switches do learn forwarding information. S3 will forward F’s packet out its upwards interface, and it is possible that E and F’s packets will collide on the vertical S2–S3 link. But it is also possible the S2–S3 link is full-duplex, able to handle simultaneous transmission in opposite directions; if not then the usual collision-backoff mechanism would allow E’s packet to reach S3 and F’s to reach S2.

Switches have revolutionized Ethernet layout: all the collision-detection rules, including the rules for maximum network diameter, apply only to collision domains, and not to the larger “virtual Ethernets” created by stringing collision domains together with switches. As we shall see below, a switched Ethernet also offers much more resistance to eavesdropping than a non-switched (eg hub-based) Ethernet.

Switch Costs

In the 1980’s the author once installed a two-port 10-Mbps Ethernet switch (then called a “bridge”) that cost $3000; cf the [MB76] quote at 2   Ethernet Basics. Today a wide variety of multiport 100-Mbps Ethernet switches are available for around $10, and almost all installed Ethernets are fully switched.

Like simpler unswitched Ethernets, the topology for a switched Ethernet is in principle required to be loop-free. In practice, however, most switches support the spanning-tree loop-detection protocol and algorithm, 3.1   Spanning Tree Algorithm and Redundancy, which automatically “prunes” the network topology to make it loop-free while allowing the pruned links to be placed back in service if a primary link fails.

While a switch does not propagate collisions, it must maintain a queue for each outbound interface in case it needs to forward a packet at a moment when the interface is busy; on (rare) occasion packets are lost when this queue overflows.

Ethernet does in principle support PAUSE management frames; a switch with a queue that has grown too large can in principle transmit these to traffic sources to pause traffic for a period of time specified in the PAUSE frame. PAUSE frames appear to be rarely used, however.

2.4.1   Ethernet Learning Algorithm¶

Traditional Ethernet switches use datagram forwarding as described in 1.4   Datagram Forwarding; the trick is to build their forwarding tables without any cooperation from ordinary, non-switch hosts. Indeed, to the extent that a switch is to act as a drop-in replacement for a hub, it cannot count on cooperation from other switches.

The solution is for the switch to start out with an empty forwarding table, and then incrementally build the table through a learning process. If a switch does not have an entry for a particular destination, it will fall back to flooding: it will forward the packet out every interface other than the one on which the packet arrived. This is sometimes also called “unknown unicast flooding”; it is equivalent to treating the destination as a broadcast address. The availability of fallback-to-flooding for unknown destinations is what makes it possible for Ethernet switches to learn their forwarding tables without any switch-to-switch or switch-to-host communication or coordination. This learning process is now part of the IEEE 802.1D standard, and is occasionally referred to as transparent bridging.

A switch learns address locations as follows: for each interface, the switch maintains a table of physical (MAC) addresses that have appeared as source addresses in packets arriving via that interface. The switch thus knows that to reach these addresses, if one of them later shows up as a destination address, the packet needs to be sent only via that interface. Specifically, when a packet arrives on interface I with source address S and destination unicast address D, the switch enters ⟨S,I⟩ into its forwarding table.

To actually deliver the packet, the switch also looks up the destination D in the forwarding table. If there is an entry ⟨D,J⟩ with J≠I – that is, D is known to be reached via interface J – then the switch forwards the packet out interface J. If J=I, that is, the packet has arrived on the same interfaces by which the destination is reached, then the packet does not get forwarded at all; it presumably arrived at interface I only because that interface was connected to a shared Ethernet segment that also either contained D or contained another switch that would bring the packet closer to D. If there is no entry for D, the switch must flood the packet out all interfaces J with J≠I; this represents the unknown-destination fallback to flooding. After a short while, the fallback-to-flooding alternative is needed less and less often, as switches learn where the active hosts are located. (However, in some switch implementations, forwarding tables also include timestamps, and entries are removed if they have not been used for, say, five minutes.)

If the destination address D is the broadcast address, or, for many switches, a multicast address, broadcast (flooding) is required. Some switches try to keep track of multicast groups, so as to forward multicast traffic only out interfaces with known subscribers; see 2.1.2   Ethernet Multicast.

Fig. 14: Five learning switches after three packet transmissions

In the diagram above, each switch’s tables are indicated by listing near each interface the destinations (identified by MAC addresses) known to be reachable by that interface. The entries shown are the result of the following packets:

A sends to B; all switches learn where A is

B sends to A; this packet goes directly to A; only S3, S2 and S1 learn where B is

C sends to B; S4 does not know where B is so this packet goes to S5; S2 does know where B is so the packet does not go to S1.

It is worth observing that, at the application layer, hosts do not commonly identify one another by their MAC addresses. In an IPv4-based network, the use of ARP (10.2   Address Resolution Protocol: ARP) to translate from IPv4 to MAC addresses would introduce additional broadcasts, which would cause the above scenario to play out differently. See exercise 10.0.

Switches do not automatically discover directly connected neighbors; S1 does not learn about A until A transmits a packet.

Once all the switches have learned where all (or most of) the hosts are, each packet is forwarded rather than flooded. At this point packets are never sent on links unnecessarily; a packet from A to B only travels those links that lie along the (unique) path from A to B. (Paths must be unique because switched Ethernet networks cannot have loops, at least not active ones. If a loop existed, then a packet sent to an unknown destination would be forwarded around the loop endlessly, though in practice this is almost always prevented by the spanning-tree algorithm, 3.1   Spanning Tree Algorithm and Redundancy.)

Switches have an additional privacy advantage in that traffic that does not flow where it does not need to flow is much harder to eavesdrop on. On an unswitched Ethernet, one host configured to receive all packets can eavesdrop on all traffic. Early Ethernets were notorious for allowing one unscrupulous station in promiscuous mode to capture, for instance, all passwords in use on the network. On a fully switched Ethernet, a host physically sees only the traffic actually addressed to it; other traffic remains inaccessible.

This switch-based privacy protection is, however, potentially vulnerable to an attack known as MAC flooding, in which a malicious host transmits a very large number of packets each with a unique, fake source address. These fake addresses fill up the switch forwarding tables, forcing the switches to discard older, legitimate entries. This in turn means that the switches will have to use fallback-to-flooding mode for legitimate addresses, allowing eavesdropping. A common Ethernet-layer defense against MAC flooding is port security, in which, typically, each port on a switch is limited in the number of forwarding-table entries it can be associated with. With this in effect, the MAC-flooding entries from any one port will be ignored once that port’s limit is reached; hopefully this will occur before legitimate entries on other ports need to be discarded. Port security is often accompanied by a mechanism to specify selected MAC addresses as secure, meaning that they do not get removed from the forwarding table even if MAC flooding is occuring. Application-layer encryption is another defense against MAC flooding.

Typical large switches have room for a forwarding table with 104 - 105 entries, though fully switched networks at the upper end of this size range are not common. The main size limitations specific to switching are the requirement that the topology must be loop-free (thus disallowing duplicate paths which might otherwise provide redundancy), and that all broadcast traffic must always be forwarded everywhere. As a switched Ethernet grows, broadcast traffic comprises a larger and larger percentage of the total traffic, and the organization must at some point move to a routing architecture (eg as in 9.6   IPv4 Subnets). A common recommendation is to have no more than 1000 hosts per LAN (or VLAN, 3.2   Virtual LAN (VLAN)).

2.5   Epilog¶

Ethernet dominates the (wired) LAN layer. That said, there are lots of different forms of Ethernet, covering a variety of cable types and a speed range spanning four orders of magnitude. In many ways, Ethernet is a logical interface, encompassing multiple implementations that can be interconnected only with switches. Higher-speed Ethernet has embraced full switching and exclusively point-to-point links. Once Ethernet finally abandons physical links that are bi-directional (half-duplex links), it will be collision-free and thus will no longer need a minimum packet size.

Other wired networks have largely disappeared (or have been renamed “Ethernet”). Wireless networks, however, are here to stay, and for the time being at least have inherited the original Ethernet’s collision-management concerns that Ethernet itself has grown out of.

2.6   Exercises¶

Exercises may be given fractional (floating point) numbers, to allow for interpolation of new exercises. Exercises marked with a ♢ have solutions or hints at 34.2   Solutions for Ethernet.

1.0. Simulate the contention period of five Ethernet stations that all attempt to transmit at T=0 (presumably when some sixth station has finished transmitting), in the style of the diagram in 2.1.6   Exponential Backoff Algorithm. Assume that time is measured in slot times, and that exactly one slot time is needed to detect a collision (so that if two stations transmit at T=1 and collide, and one of them chooses a backoff time k=0, then that station will transmit again at T=2). Use coin flips or some other source of randomness.

2.0. Suppose we have Ethernet switches S1 through S3 arranged as below; each switch uses the learning algorithm of 2.4   Ethernet Switches. All forwarding tables are initially empty.

S1────────S2────────S3───D

│ │ │

A B C

(a). If A sends to B, which switches see this packet?

(b). If B then replies to A, which switches see this packet?

(c). If C then sends to B, which switches see this packet?

(d). If C then sends to D, which switches see this packet?

3.0.♢ Suppose we have the Ethernet switches S1 through S4 arranged as below. All forwarding tables are empty; each switch uses the learning algorithm of 2.4   Ethernet Switches.

B

│

S4

│

A───S1────────S2────────S3───C

│

D

Now suppose the following packet transmissions take place:

A sends to D

D sends to A

A sends to B

B sends to D

For each switch S1-S4, list what source addresses (eg A,B,C,D) it has seen (and thus what nodes it has learned the location of).

4.0. Repeat the previous exercise (3.0), with the same network layout, except that instead the following packet transmissions take place:

A sends to B

B sends to A

C sends to B

D sends to A

For each switch, list what source addresses (eg A,B,C,D) it has seen (and thus what nodes it has learned the location of).

5.0. In the switched-Ethernet network below, find two packet transmissions so that, when a third transmission A⟶D occurs, the packet is seen by B (that is, it is flooded out all ports by S2), but is not similarly seen by C (because it is forwarded to D, not flooded, by S3). All forwarding tables are initially empty, and each switch uses the learning algorithm of 2.4   Ethernet Switches.

B C

│ │

A───S1────────S2────────S3───D

Hint: Destination D must be in S3’s forwarding table, but must not be in S2’s. So there must have been a packet sent by D that was seen by S3 but not by S2.

6.0. Given the Ethernet network with learning switches below, with (disjoint) unspecified parts represented by ?, explain why it is impossible for a packet sent from A to B to be forwarded by S1 directly to S2, but to be flooded by S2 out all of S2’s other ports.

? ?

| |

A───S1────────S2───B

7.0. In the diagram below, from 2.4.1   Ethernet Learning Algorithm, suppose node D is connected to S5. Now, with the tables as shown by the labels in the diagram (that is, S5 knows about A and C, etc), D sends to B.

Which switches will see this D→B packet, and thus learn about D? Of these switches, which do not already know where B is and will use fallback-to-flooding?

8.0. Suppose two Ethernet switches are connected in a loop as follows; S1 and S2 have their interfaces 1 and 2 labeled. These switches do not use the spanning-tree algorithm, 3.1   Spanning Tree Algorithm and Redundancy.

Suppose A attempts to send a packet to destination B, which is unknown. S1 will therefore flood the packet out interfaces 1 and 2. What happens then? How long will A’s packet circulate?

9.0. Suppose you want to develop a new protocol so that Ethernet switches participating in a VLAN all keep track of the VLAN “color” associated with every destination in their forwarding tables. Assume that each switch knows which of its ports (interfaces) connect to other switches and which may connect to hosts, and in the latter case knows the color assigned to that port.

(a). Suggest a way by which switches might propagate this destination-color information to other switches.

(b). What must be done if a port formerly reserved for connection to another switch is now used for a host?

10.0. Consider the scenario from 2.4.1   Ethernet Learning Algorithm:

The following packet transmissions occur:

A sends to B

B sends to A

C sends to B

Now suppose that, before each packet transmission above, the sender first sends a broadcast packet, and the destination then sends a unicast reply packet (this is roughly the ARP protocol, used to translate from IPv4 addresses to Ethernet physical addresses, 10.2   Address Resolution Protocol: ARP). After the three transmissions listed above, what destinations do the switches S1-S5 have in their forwarding tables?

Navigation

index

next |

previous |

An Introduction to Computer Networks, desktop edition 2.0.11 »

© Copyright 2012-2022, Peter L Dordal.

Created using Sphinx 1.8.5.