Ethernet Frame Format — Fields, Size and How It Works

An Ethernet frame is the unit of data at Layer 2. Everything you send over a wired network, an IP packet, an ARP request, an STP BPDU, travels inside one. Understanding its fields explains MTU, jumbo frames, VLAN tagging, runts and giants, and most Layer 2 troubleshooting.

Frame Structure

The preamble, SFD and interframe gap are physical-layer overhead and are not counted in the frame size. The frame itself, destination MAC through FCS, is 64 bytes minimum, 1518 bytes maximum (1522 with a VLAN tag).

The Fields That Matter in Practice

MAC addresses

Six bytes each, usually written as 00:1A:2B:3C:4D:5E. The first three bytes are the OUI, assigned to a manufacturer, which is why you can look up a vendor from a MAC address. The last three are assigned by that manufacturer.

Two bits in the first byte carry meaning:

• I/G bit (least significant bit of the first byte): 0 = unicast, 1 = multicast. The broadcast address FF:FF:FF:FF:FF:FF is the all-ones case.
• U/L bit: 0 = globally unique (burned in), 1 = locally administered (software-assigned). Randomised MAC addresses on phones set this bit.

A switch reads the source MAC to learn, and the destination MAC to forward. See Layer 2 switching for how that works.

EtherType vs Length, the two frame formats

The same 2-byte field means different things depending on its value, which is a historical artefact of Ethernet II and IEEE 802.3 coexisting:

• Value ≥ 1536 (0x0600), it is an EtherType, identifying the payload protocol. This is Ethernet II, and it is what essentially all traffic uses today.
• Value ≤ 1500, it is a length, and the frame is IEEE 802.3 with an LLC header inside the payload. Used now mainly by STP and other control protocols.

Because the maximum payload is 1500 and the minimum EtherType is 1536, the two interpretations never collide.

Why the minimum payload is 46 bytes

The 64-byte minimum frame size is not arbitrary. On the original shared-medium Ethernet, a station had to still be transmitting when a collision signal could reach it from the far end of the segment, otherwise it would never detect the collision. 64 bytes was the transmission time that guaranteed this across the maximum legal cable length.

Payloads shorter than 46 bytes are therefore padded to reach it. A frame arriving shorter than 64 bytes is a runt, and on modern full-duplex links a runt indicates corruption or a faulty NIC rather than a collision.

The FCS

A CRC-32 computed over everything from the destination MAC to the end of the payload. The receiver recomputes it and silently discards the frame if it does not match. Ethernet has no retransmission, recovery is TCP’s job at a higher layer.

Rising CRC error counters are one of the most useful diagnostics available:

Switch# show interfaces GigabitEthernet0/5 | include CRC|runts|giants|input errors

CRC errors point at a physical problem, a damaged cable, a failing SFP, an EMI source, or a duplex mismatch.

VLAN Tagging, 802.1Q

A tagged frame has 4 extra bytes inserted after the source MAC, pushing the maximum frame size to 1522:

Access ports send and receive untagged frames. Trunk ports carry tagged frames, with one exception: the native VLAN is sent untagged. QinQ (802.1ad) stacks a second tag for service-provider use.

Jumbo Frames

A jumbo frame carries a payload larger than 1500 bytes, typically 9000. There is no IEEE standard for them, it is a de facto convention, which is why MTU mismatches are so common.

• Benefit: fewer frames for the same data means less per-frame processing overhead. Meaningful for storage traffic (iSCSI, NFS), backups and data centre east-west traffic.
• Requirement: every device in the path must agree, both hosts, every switch, every router interface. One device at 1500 and the large frames are silently dropped.
• Symptom of a mismatch: small transfers work perfectly, large ones hang. Ping succeeds, file copies stall.

# Test path MTU with a DF-bit ping
ping -M do -s 8972 10.10.10.5     # Linux, 8972 + 28 = 9000
ping -f -l 8972 10.10.10.5        # Windows

Do not enable jumbo frames on a general-purpose LAN. The gain is small and the failure mode is confusing. Enable them on a dedicated storage or backup VLAN where you control every device in the path.

Frame Size Reference

Frequently Asked Questions

What is the maximum size of an Ethernet frame?

1518 bytes for a standard frame, 14 bytes of header, up to 1500 bytes of payload, and 4 bytes of FCS. A VLAN tag adds 4 more, making 1522.

Why is the Ethernet MTU 1500 bytes?

It was a compromise between efficiency and the buffer memory available in 1980s hardware, and it stuck because changing it would break interoperability everywhere. Larger MTUs exist as jumbo frames but were never standardised.

What is the difference between Ethernet II and 802.3?

Ethernet II uses the 2-byte field as an EtherType identifying the payload protocol. IEEE 802.3 uses it as a length and puts an LLC header inside the payload. Values of 1536 and above are EtherTypes; 1500 and below are lengths. Almost all data traffic today is Ethernet II.

What causes CRC errors?

Physical-layer problems, a damaged or out-of-spec cable, a failing transceiver, electromagnetic interference, or a duplex mismatch. CRC errors are effectively never a software or configuration issue.

Is the preamble part of the frame?

No. The preamble and start frame delimiter are physical-layer synchronisation and are not counted in the 64–1518 byte range, nor covered by the FCS.

Why do I see 1522-byte frames on a trunk?

Those are tagged frames, the 802.1Q tag adds 4 bytes. They are sometimes called baby giants and switches must be configured to accept them on trunk links.