Preamble (7 bytes) + SFD (1 byte)

The preamble is 7 bytes of alternating 1s and 0s (10101010...). It allows the receiver's clock to synchronise with the sender's clock before actual data arrives — like a "ready?" signal. The Start Frame Delimiter (SFD) is 10101011 — the final bit breaks the alternating pattern to signal "frame starts NOW". These 8 bytes are added and stripped by the NIC hardware and never appear in software packet buffers.

Destination MAC Address (6 bytes)

The hardware address of the intended recipient. The switch uses this to decide which port to forward the frame to. Three special cases:

• Unicast — sent to one specific device (LSB of first byte = 0)
• Broadcast — FF:FF:FF:FF:FF:FF — all devices on the segment receive it
• Multicast — 01:00:5E:xx:xx:xx for IPv4 multicast — sent to a group of devices

Source MAC Address (6 bytes)

The hardware address of the sender. Switches read this field to learn which MAC address is reachable on which port and build their MAC address table.

EtherType (2 bytes)

Identifies the Layer 3 protocol carried in the payload. Most important values:

• 0x0800 — IPv4 payload
• 0x0806 — ARP payload
• 0x86DD — IPv6 payload
• 0x8100 — 802.1Q VLAN tag (frame is VLAN-tagged)
• 0x88CC — LLDP (Link Layer Discovery Protocol)
• 0x8847 — MPLS unicast

In DPDK and VPP, the EtherType field is the first thing the ethernet-input graph node reads to dispatch the frame to the correct next node (ip4-input, ip6-input, arp-input, etc.).

Payload / Data (46–1500 bytes)

The IP packet (or ARP message, or other L3 PDU) carried by the frame. The minimum payload is 46 bytes — if the IP packet is smaller, it gets padded with zeros to reach 46 bytes. This ensures the total frame is at least 64 bytes, which is required for collision detection in half-duplex Ethernet (legacy).

FCS / CRC (4 bytes)

Frame Check Sequence — a 32-bit CRC (Cyclic Redundancy Check) computed over all frame fields from Destination MAC through Payload. The receiver recomputes the CRC and compares to the transmitted value. If they differ, the frame is silently dropped (no error is sent back — error recovery is TCP's job at L4). NICs typically handle CRC computation in hardware, and most OSes strip the FCS before passing the frame to software — so you won't see it in Wireshark captures from a NIC in normal mode.

MTU — Maximum Transmission Unit

The maximum payload size is 1500 bytes — this is the standard Ethernet MTU. If an IP packet is larger, it must be fragmented at the IP layer (or the application told to send smaller chunks via Path MTU Discovery). Many data-centre networks use Jumbo Frames with MTU 9000 bytes to reduce CPU overhead for large transfers — your DPDK/VPP setup likely uses jumbo frames.

A MAC address has a precise internal structure:

• OUI (bytes 1–3) — Assigned by IEEE to each NIC manufacturer. Identifies the vendor. Examples: 00:1A:2B = Cisco, 24:8A:07 = Mellanox/NVIDIA, 3C:FD:FE = Intel. You can look up any OUI at https://regauth.standards.ieee.org/
• NIC-specific (bytes 4–6) — Assigned by the manufacturer to uniquely identify the specific interface within all their products

Two special bits in byte 1:

• Bit 0 (LSB) — I/G bit (Individual/Group): 0 = unicast (sent to one device), 1 = multicast/broadcast (sent to a group)
• Bit 1 — U/L bit (Universal/Local): 0 = globally unique (burned-in OUI), 1 = locally administered (manually assigned or randomly generated)

/* Reading MAC address bits in C (network byte order) */
uint8_t mac[6] = {0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff};

/* Check if unicast or multicast/broadcast */
if (mac[0] & 0x01)
    printf("Multicast or broadcast\n");
else
    printf("Unicast\n");

/* Check if globally or locally administered */
if (mac[0] & 0x02)
    printf("Locally administered MAC\n");
else
    printf("Globally unique (OUI assigned)\n");

/* Broadcast check: all bytes == 0xFF */
if (memcmp(mac, "\xff\xff\xff\xff\xff\xff", 6) == 0)
    printf("Broadcast frame\n");

ARP is carried directly in an Ethernet frame with EtherType 0x0806. The ARP message itself has a fixed format:

The Operation field distinguishes requests (1) from replies (2). In a request, the Target MAC is 00:00:00:00:00:00 (unknown — that's what we're asking for). The entire request is sent as an Ethernet broadcast (FF:FF:FF:FF:FF:FF).

A switch is a Layer 2 device that connects multiple Ethernet devices and forwards frames between them intelligently — sending each frame only to the port where the destination MAC address is reachable, rather than flooding to all ports like an old hub.

Switches maintain a MAC Address Table (also called the CAM table — Content-Addressable Memory). This table maps MAC addresses to switch ports. It is built dynamically through MAC address learning.

MAC Learning — How the Table Gets Built

When a switch receives a frame on port X from source MAC aa:bb:cc:dd:ee:ff, it records: "MAC aa:bb:cc:dd:ee:ff is reachable on port X". It does this for every frame it receives — gradually building a complete map of which MAC address is behind which port.

Frame Forwarding Decision

When a switch receives a frame, it makes one of three decisions based on the destination MAC:

• Known unicast — destination MAC is in the MAC table → forward ONLY to the listed port
• Unknown unicast — destination MAC is NOT in the table → flood to ALL ports except the port it arrived on (this is how new MACs get discovered)
• Broadcast/Multicast — destination is FF:FF:FF:FF:FF:FF or multicast → flood to ALL ports except the arrival port

IEEE 802.1Q adds a 4-byte VLAN tag to the Ethernet frame between the Source MAC and the EtherType field. The EtherType 0x8100 signals that a VLAN tag follows:

VLAN tag fields:

• TPID (Tag Protocol Identifier, 0x8100) — identifies this as an 802.1Q tagged frame
• PCP (Priority Code Point, 3 bits) — 802.1p QoS priority 0–7 (7=highest). Used by switches to prioritise traffic
• DEI (Drop Eligible Indicator, 1 bit) — marks frames that can be dropped under congestion
• VID (VLAN Identifier, 12 bits) — VLAN number 0–4095. VLAN 0 = untagged/no VLAN, VLAN 1 = default, VLAN 4095 = reserved. Usable range: 1–4094

The VLAN tag increases the maximum frame size from 1518 to 1522 bytes.

STP (IEEE 802.1D) prevents loops by automatically blocking redundant ports while keeping one active path between any two network points — a loop-free logical tree topology. STP runs between switches automatically using special messages called BPDUs (Bridge Protocol Data Units).

STP Election Process — 3 Steps

1. Elect a Root Bridge — All switches exchange BPDUs and elect one switch as the "root" of the spanning tree. The switch with the lowest Bridge ID wins. Bridge ID = Priority (default 32768) + MAC address. You can manually set priority lower to control which switch becomes root.
2. Elect Root Ports — Each non-root switch selects one root port: the port with the lowest-cost path to the root bridge. Cost is based on link speed (higher speed = lower cost: 10 Gbps = cost 2, 1 Gbps = cost 4, 100 Mbps = cost 19).
3. Elect Designated Ports and Block Others — For each network segment, one switch port is elected as the designated port (the one closest to root). All other ports on that segment are put into blocking state — they receive but do not forward frames. This breaks all loops.