Ethernet Frames & L2 Switching
Layer 2 is where bits become structured data. Master the exact byte lengths of an Ethernet frame, how MAC addresses are structured, and the fundamental learning/forwarding logic of a network switch.
Anatomy of an Ethernet Frame (802.3)
| Field | Size | Function |
|---|---|---|
| Preamble | 7 Bytes | A pattern of alternating 1s and 0s used to synchronize the clocks of the receiving and transmitting network cards. It essentially says, 'Wake up, a frame is coming.' |
| SFD (Start Frame Delimiter) | 1 Byte | Always set to 10101011. It marks the exact end of the Preamble and indicates that the very next bit is the start of the Destination MAC Address. |
| Destination MAC | 6 Bytes | The physical address of the intended recipient. The switch reads this to determine which port to forward the frame out of. |
| Source MAC | 6 Bytes | The physical address of the sender. The switch reads this to build its internal MAC Address Table (learning). |
| Type / Length (EtherType) | 2 Bytes | Identifies the Layer 3 protocol encapsulated inside the payload. For example, 0x0800 means the payload is an IPv4 packet; 0x86DD means it is IPv6. |
| Payload (Data) | 46 - 1500 Bytes | The actual data being sent (the IP packet). If the data is less than 46 bytes, 'padding' is added to meet the minimum size requirement. |
| FCS (Frame Check Sequence) | 4 Bytes | Contains the CRC (Cyclic Redundancy Check) value. The sender runs a mathematical formula on the frame and puts the result here. The receiver runs the same formula. If the results don't match, the frame was corrupted in transit and is immediately dropped. |
When you log into a client's switch and run show interfaces, pay close attention to the CRC counter. If you see CRC errors steadily increasing, it means frames are arriving corrupted and failing the FCS math check. This is almost always caused by a physically damaged cable, electromagnetic interference (EMI), or a duplex mismatch (Half-Duplex vs Full-Duplex).
The 48-Bit MAC Address
OUI (Organizationally Unique Identifier)
First 24 Bits (3 Bytes)Assigned by the IEEE to the manufacturer. If you see a MAC address starting with '00:14:22', you instantly know it is a Dell device.
NIC Specific (Vendor Assigned)
Last 24 Bits (3 Bytes)A unique serial number assigned by the manufacturer to that specific Network Interface Card. No two NICs from the same vendor should ever have the same last 24 bits.
Core Switch Logic
Learning (Source MAC)
When a frame enters a switch port, the switch immediately looks at the Source MAC. It records that MAC address and the port it came from in its MAC Address Table (CAM Table). This is how a switch 'learns' where devices live.
Forwarding (Destination MAC)
Next, the switch looks at the Destination MAC. It checks its table. If it knows which port that MAC lives on, it forwards the frame out ONLY that specific port.
Flooding (Unknown Unicast)
If the switch looks at the Destination MAC and does NOT have it in its table, it panics and 'floods' the frame out of every single port in the VLAN (except the port it came in on) hoping the destination device will receive it and reply.