I simply wanted to summarize here all the information I’ve gathered about the syntax and terminology of the Ethernet standards. While reading articles online or listening to discussions, I noticed that many people often misuse terms such as “packet”, “frame”… My goal is therefore to provide a reliable, well-sourced reference that clearly defines the correct technical terminology.
Ethernet Frame Standards
An Ethernet Frame is precede by a preambule and start frame delimiter (SFD). These two are not part of the Ethernet Frame but are added by the data link layer.
There are multiple Ethernet frame standards in use today. The most common are Ethernet II and IEEE 802.3. While they are quite similar, Ethernet II is by far the most widely adopted.
Ethernet II (a.k.a DIX Ethernet) - Developed by DEC, Intel and Xerox before IEEE standardized Ethernet
IEEE 802.3 (original, 1983) - The first official IEEE standard for Ethernet
In the Ethernet II standard, the meaning of the EtherType field is straightforward : it identifies the upper-layer protocol encapsulated in the payload of the Frame (e.g., IPv4, IPv6, ARP).
In IEEE 802.3, however, the same 2-byte field represents the payload length in bytes, with a maximum value of 1500.
Since both standards can coexist, the distinction is made based on this field’s value:
- If the value is ≤ 0x05DC (1500 decimal), the frame is IEEE 802.3.
- If the value is ≥ 0x0600 (1536 decimal), the frame is Ethernet II.
- Values in between 0x05DD - 0x05FF (1501 - 1535 decimal) are undefined. (Historical choice from IEEE to clearly identify both standards)
Here is an Ethernet Frame captured on my network and displayed with Wireshark :
We can see that it’s a Ethernet II frame thanks to the “Type” field containing 0x0800 , meaning i’m using IPv4 upper-layer protocol.
802.1Q VLAN Tagging (optional)
The IEEE 802.1Q standard adds support for VLAN tagging in Ethernet frames. When an Ethernet frame enters a VLAN-aware part of the network, a VLAN tag is inserted to indicate its VLAN membership.
If a frame enters the VLAN-aware network without a VLAN tag, it is assumed to belong to the native VLAN.
802.1Q inserts a 4 bytes field immediately after the Source MAC address and before the EtherType/Length field in the original Ethernet frame.
Because of this addition, the maximum Ethernet frame size increases from 1518 bytes to 1522 bytes.
- Tag Protocol Identified (TPID) : Always
0x810, indicate “This is a VLAN-tagged frame” - Tag Control Information (TCI) : Contains the following sub-field :
- Priority Code Point (PCP) : Used for QoS, mapping the IEEE 802.1q priority Classes
- Drop Eligible Indicator (DEI) : Signals whether a frame can be dropped in case of congestion, almost always set to 0 in Ethernet environments
- VLAN Identifier (VID) : Assigns the frame to VLAN 1 – 4094. 0 = priority-only and 4095 = reserved
Runt Frames
An Ethernet runt frame is an Ethernet frame that is smaller than the minimum legal size for Ethernet : 46 bytes of payload (minimum) + 18 bytes of Ethernet header/trailer = 64 bytes total.
If you want to find out why do we have a 64 bytes minimum length for Ethernet Frames, feel free to read this post.
Sources :
- Ethernet standards : https://en.wikipedia.org/wiki/Ethernet_frame