Ethernet II frame

This Ethernet format is the most popular frame type on Ethernet TCP/IP networks. This frame is the default for Microsoft Windows 2000 Ethernet networks.

Novell designation: Ethernet_II.
Cisco designation: arpa.

The Ethernet frame length is between 64 and 1518 octets (not bytes - a byte can be either 7 or 8 bits in length, an octet is 8 bits long).

The Internet Standard for Ethernet networks can be found in RFC 894.

Preamble: 101010...1011
Destination:Destination Node (MAC) address.
Source: Source Node (MAC) address
Type: Length of the data field
Data: Higher layer Protocols and information
Frame Check Sequence: CRC (cyclic redundancy check)

Preamble

The Preamble is eight octets long and consists of alternating 1s and 0s. The preamble always ends in 11. Ethernet devices use the preamble to synchronize clocks for data transfer.

Network interface cards do not process the preamble in memory so packet analyzers do not display this header

A destination address of all ones is a broadcast address.

Destination

The destination is a Media Access Control (MAC) address, and is six octets long. This field is the destination of the packet on the local network (or subnet), if the final destination is on a different network this field will contain the address of the router. The ultimate destination, on the larger network, will be found in the data portion of the packet.

This field is also known as the Data Link address, Layer 2 address, MAC address, or hardware address.

The first three octets of a MAC address are assigned to a company by the IEEE. The last three octets are generated by the manufacturer of the network device.

Source

The source is the address of the Ethernet device that sent the packet. It is a Media Access Control (MAC) address, and is six octets long.

This field is also known as the Data Link address, Layer 2 address, MAC address, or hardware address.

The first three octets of a MAC address are assigned to a company by the IEEE. The last three octets are generated by the manufacturer of the network device.

Type

The Type field is 2 octets long. The type is also called the Ethertype, and it designates the protocol that the Ethernet frame is using. The protocols and associated types are maintained by the IEEE, and can be viewed at the IEEE web site as well as other locations on the World Wide Web.

Type	Protocol
0800	IP version 4
0806	Address Resolution Protocol (ARP)
6004	DEC LAT
8035	Reverse ARP
8137	Novell's Internetwork Packet Exchange (IPX)

Data

The data field is variable in length with a minimum of 46 bytes and a maximum of 1500 bytes.

Frame Check Sequence (FCS)

The Frame Check Sequence (FCS) is four octets long, and is a result of a Cyclic Redundancy Check (CRC) performed on the first part of the frame (excluding the preamble).