What is the Ethernet Frame Format?
Learn the Ethernet frame format field by field — preamble, MAC addresses, EtherType, payload, and FCS — with interview Q&A.
Expected Interview Answer
An Ethernet frame is the Layer 2 container that carries data across a local network, made up of a preamble, destination and source MAC addresses, an EtherType/length field, the payload, and a trailing Frame Check Sequence used for error detection.
Every Ethernet frame starts with a 7-byte preamble and a 1-byte start-of-frame delimiter that let the receiving NIC synchronize its clock to the incoming bit stream. Next come the 6-byte destination MAC address and 6-byte source MAC address, which a switch reads to decide which port to forward the frame out of. The 2-byte EtherType field identifies the payload’s upper-layer protocol (for example 0x0800 for IPv4), followed by the payload itself, which ranges from 46 to 1500 bytes under the standard MTU (jumbo frames extend this). The frame ends with a 4-byte Frame Check Sequence, a CRC32 checksum the receiver recomputes to detect transmission errors and silently drop corrupted frames. Optional 802.1Q VLAN tags can be inserted after the source address to carry VLAN ID and priority information.
- Preamble synchronizes sender and receiver clocks before data starts
- MAC addresses let switches forward frames to the correct port
- EtherType tells the receiving stack which protocol to hand the payload to
- FCS checksum lets receivers detect and discard corrupted frames
AI Mentor Explanation
An Ethernet frame is like a delivery bag a runner carries onto the field: a warm-up gesture gets the umpire’s attention first (preamble), then a tag lists exactly who it is from and who it is for (source and destination MAC), a small label states what kind of item is inside (EtherType), the actual gear sits in the middle (payload), and a checksum tag at the end lets the receiving player confirm nothing was damaged in transit (FCS). If the checksum tag does not match what arrived, the player refuses the bag rather than use damaged gear. This structured wrapping around raw gear is exactly what a frame does around raw data.
Step-by-Step Explanation
Step 1
Preamble & SFD
A 7-byte preamble plus 1-byte start-of-frame delimiter synchronize the receiving NIC clock.
Step 2
Addressing
6-byte destination and 6-byte source MAC addresses tell a switch where to forward the frame.
Step 3
EtherType & payload
A 2-byte EtherType identifies the upper-layer protocol, followed by a 46-1500 byte payload.
Step 4
Frame Check Sequence
A 4-byte CRC32 at the end lets the receiver detect and drop corrupted frames.
What Interviewer Expects
- Names the fields in order: preamble, MAC addresses, EtherType, payload, FCS
- Knows MAC address fields are 6 bytes each
- Understands the payload size range (46-1500 bytes, MTU)
- Explains FCS as a CRC32 error-detection checksum
Common Mistakes
- Confusing EtherType with an IP protocol number
- Forgetting the minimum payload size (46 bytes, with padding)
- Thinking FCS corrects errors instead of only detecting them
- Mixing up frame fields with IP packet header fields
Best Answer (HR Friendly)
“An Ethernet frame is the envelope that carries data across a wired or Wi-Fi local network. It has a sync signal at the start, the sender and receiver’s hardware addresses, a note on what type of data is inside, the actual data, and a checksum at the end so the receiver can tell if anything got corrupted along the way.”
Code Example
# Capture raw Ethernet frame headers on an interface
sudo tcpdump -e -n -c 5 -i eth0
# Example output shows source/destination MAC and EtherType:
# 00:1a:2b:3c:4d:5e > 00:aa:bb:cc:dd:ee, ethertype IPv4 (0x0800), length 74:
# 10.0.0.5.443 > 10.0.0.10.51422: Flags [P.], seq 1:21, ack 1, length 20Follow-up Questions
- What is the minimum and maximum size of an Ethernet frame?
- How does 802.1Q VLAN tagging modify the frame format?
- What happens to a frame that fails the FCS check?
- How does jumbo frame support change the standard MTU?
MCQ Practice
1. How many bytes does a standard Ethernet MAC address field occupy?
Both the source and destination MAC address fields are 6 bytes each in an Ethernet frame.
2. What does the Frame Check Sequence (FCS) field verify?
FCS is a CRC32 checksum the receiver recomputes to detect frame corruption.
3. What is the standard maximum Ethernet payload size (MTU)?
The standard Ethernet MTU limits the payload to 1500 bytes (jumbo frames extend this).
Flash Cards
Order of Ethernet frame fields? — Preamble, SFD, destination MAC, source MAC, EtherType, payload, FCS.
Size of each MAC address field? — 6 bytes.
What does FCS detect? — Transmission errors, via a CRC32 checksum recomputed by the receiver.
Standard Ethernet payload range? — 46 to 1500 bytes (jumbo frames go beyond 1500).