I simply wanted to summarize here all the information I’ve gathered about the syntax and terminology of the Ethernet standards. While reading articles online or listening to discussions, I noticed that many people often misuse terms such as “packet”, “frame”… My goal is therefore to provide a reliable, well-sourced reference that clearly defines the correct technical terminology.
Ethernet Frame Standards
An Ethernet Frame is precede by a preambule and start frame delimiter (SFD). These two are not part of the Ethernet Frame but are added by the data link layer.
There are multiple Ethernet frame standards in use today. The most common are Ethernet II and IEEE 802.3. While they are quite similar, Ethernet II is by far the most widely adopted.
Ethernet II (a.k.a DIX Ethernet) - Developed by DEC, Intel and Xerox before IEEE standardized Ethernet
IEEE 802.3 (original, 1983) - The first official IEEE standard for Ethernet
In the Ethernet II standard, the meaning of the EtherType field is straightforward : it identifies the upper-layer protocol encapsulated in the payload of the Frame (e.g., IPv4, IPv6, ARP).\
Since both standards can coexist, the distinction is made based on this field’s value:
- If the value is ≤ 0x05DC (1500 decimal), the frame is IEEE 802.3.
- If the value is ≥ 0x0600 (1536 decimal), the frame is Ethernet II.
- Values in between 0x05DD - 0x05FF (1501 - 1535 decimal) are undefined. (Historical choice from IEEE to clearly identify both standards)
Here is an Ethernet Frame captured on my network and displayed with Wireshark :
We can see that it’s a Ethernet II frame thanks to the “Type” field containing 0x0800 , meaning i’m using IPv4 upper-layer protocol.
802.1Q VLAN Tagging (optional)
In 1998 the IEEE 802.1Q standard adds support for VLAN tagging in Ethernet frames. When an Ethernet frame enters a VLAN-aware part of the network, a VLAN tag is inserted to indicate its VLAN membership.
If a frame enters the VLAN-aware network without a VLAN tag, it is assumed to belong to the native VLAN.
802.1Q inserts a 4 bytes field immediately after the Source MAC address and before the EtherType/Length field in the original Ethernet frame.
- Tag Protocol Identified (TPID) : Always
0x810, indicate “This is a VLAN-tagged frame” - Tag Control Information (TCI) : Contains the following sub-field :
- Priority Code Point (PCP) : Used for QoS, mapping the IEEE 802.1q priority Classes
- Drop Eligible Indicator (DEI) : Signals whether a frame can be dropped in case of congestion, almost always set to 0 in Ethernet environments
- VLAN Identifier (VID) : Assigns the frame to VLAN 1 – 4094. 0 = priority-only and 4095 = reserved
Because of this Header addition, the maximum Ethernet frame size increased from 1518 bytes to 1522 bytes, we call it “Baby Jumbo Ethernet Frame”.
At the time, not all vendors supported this change, since many devices used a hard-coded limit of 1518 bytes for allowable Ethernet frames, causing larger frames to be dropped.\
Then, in 2006 an IEEE study group released the amendment 802.3as to officially extend Ethernet frame size support up to 2000 bytes, providing 482 bytes more for additional headers and options such as 802.1Q, Q-in-Q, Ethernet OAM, or MACsec.
Jumbo Frames
As each Ethernet frame must be processed as it passes through the network, processing the contents of a single large frame is preferable to processing the same content broken up into smaller frames, as this makes better use of available CPU time by reducing interrupts. This also minimizes the overhead byte count and reduces the number of frames needing to be processed.
Introducing “Jumbo Frames”, A Jumbo Frame is an Ethernet Frame with a Payload greater than the standard 1500 bytes. They are not oficially defined in the IEEE 802.3 standard so vender support may vary as well as their maximum payload size. The most common Jumbo Frame size is 9000 bytes for the Payload.
A single 9 KB jumbo frame can replace six 1.5 KB standard frames, reducing the total number of frames by five and lowering CPU usage across the network.
Jumbo frames are commonly used in data centers to accelerate large file transfers. The main downside is that the entire network segment must support jumbo frames to avoid fragmentation or dropped packets.
Today, most Ethernet equipment can handle jumbo frames up to 9216 bytes.
Runt Frames
An Ethernet runt frame is an Ethernet frame that is smaller than the minimum legal size for Ethernet : 46 bytes of payload (minimum) + 18 bytes of Ethernet header/trailer = 64 bytes total.
If you want to find out why do we have a 64 bytes minimum length for Ethernet Frames, feel free to read this post.
Sources :
- Ethernet standards : https://en.wikipedia.org/wiki/Ethernet_frame
- Jumbo Frames : https://www.techtarget.com/searchnetworking/definition/jumbo-frames?ref=packetcoders.io
- Jumbo Frames : https://en.wikipedia.org/wiki/Jumbo_frame