Ethernet Basics
Part of Networking
The fundamental technology underlying most local area networks.
Why This Matters
Ethernet is the dominant local area network technology. Developed at Xerox PARC in the early 1970s and standardized as IEEE 802.3, it has evolved from a 10 Mbps bus network to today’s multi-gigabit switched networks while maintaining backward compatibility through all generations. Understanding Ethernet means understanding the foundation of nearly every local network you will encounter.
Ethernet’s success stems from its simplicity and extensibility. The core concepts — frames with source and destination addresses, carrier sense with collision detection, and a clear layered structure — are straightforward enough to implement with modest hardware yet sophisticated enough to scale to very high performance. Every generation of Ethernet has maintained compatibility with the frame format, so a device from 1990 can communicate with a device from 2020 if they share a physical connection.
In a reconstruction context, Ethernet hardware is among the most common and recoverable networking equipment. Old Ethernet cards, switches, and cables are available in enormous quantities from salvaged computers and offices. Understanding how to use this hardware, what its limitations are, and how to verify it is working correctly is practical knowledge for building real networks.
The Ethernet Frame
The Ethernet frame is the fundamental unit of data transmission. Every piece of data that moves across an Ethernet network is encapsulated in one or more frames. Understanding the frame structure is essential for understanding how Ethernet works.
The frame consists of: a preamble (7 bytes of alternating 1 and 0 bits, used for synchronization), a start-of-frame delimiter (1 byte, 10101011, marking the end of the preamble), the destination MAC address (6 bytes), the source MAC address (6 bytes), an EtherType or length field (2 bytes), the payload data (46 to 1500 bytes), and a frame check sequence (4 bytes, CRC-32).
The MAC addresses are 48-bit values assigned to network interfaces at manufacture. Each interface should have a globally unique MAC address, though in practice uniqueness is not enforced and duplicate addresses can exist. The first three bytes of a MAC address are the Organizationally Unique Identifier (OUI), assigned to the manufacturer. The last three bytes are assigned by the manufacturer to individual interfaces.
The EtherType field (when its value is 1536 or higher) indicates the protocol of the payload: 0x0800 for IPv4, 0x0806 for ARP, 0x86DD for IPv6. When the field value is 1500 or less, it is interpreted as a length field (older 802.3 format). Modern Ethernet almost exclusively uses the EtherType interpretation.
The minimum frame payload is 46 bytes (plus headers for 64 bytes total including CRC). This minimum exists for CSMA/CD collision detection to work correctly — a too-short frame would finish transmitting before its collision signal could return. If the payload is smaller than 46 bytes, padding bytes are added. The maximum payload is 1500 bytes, the standard Maximum Transmission Unit (MTU). Some systems support jumbo frames with larger MTUs, but this requires explicit configuration.
Physical Media Standards
Ethernet has run over many different physical media through its history. Each medium is specified as a separate physical layer standard, but all share the same MAC layer and frame format.
10Base5 (Thick Ethernet): The original Ethernet, using thick coaxial cable. Devices attached to the cable using a vampire tap that pierced the cable jacket. Maximum segment length 500 meters, up to 100 devices per segment. Obsolete but foundational.
10Base2 (Thin Ethernet, Cheapernet): Thinner, more flexible coaxial cable with BNC connectors. Maximum segment length 185 meters, up to 30 devices per segment. Devices daisy-chained with T-connectors. Simpler to install than 10Base5 but still bus topology with all collision problems.
10BaseT / 100BaseTX / 1000BaseT: Twisted-pair copper cable with RJ-45 connectors. Star topology with a hub or switch at the center. This is the dominant form of Ethernet. Cat3 cable for 10 Mbps, Cat5e for 100 Mbps and 1000 Mbps, Cat6 for better performance at gigabit speeds. Maximum cable length 100 meters between device and hub/switch.
100BaseFX / 1000BaseSX / 1000BaseLX: Fiber optic cable. Much longer maximum distances (up to 70 km for single-mode fiber), immune to electrical interference, electrically isolated (important in industrial environments and lightning-prone areas). More expensive and more difficult to terminate than copper.
When selecting media for a new installation, twisted-pair copper Cat5e or Cat6 is the practical choice for runs up to 100 meters. For longer runs or environments with strong electrical interference, fiber optic is required.
Auto-Negotiation
Modern Ethernet devices support auto-negotiation, a process by which two connected devices agree on the best common mode of operation. Auto-negotiation handles speed (10/100/1000 Mbps) and duplex mode (half-duplex or full-duplex) without manual configuration.
When a link is established, both devices send Fast Link Pulses (FLPs) that encode their capabilities. The devices select the highest common mode — if both support 1000BaseT full-duplex, they operate at 1 Gbps full-duplex. If one supports only 100BaseTX, they negotiate down to 100 Mbps.
Auto-negotiation failures cause common problems. If one device has auto-negotiation enabled and the other is manually configured, the auto-negotiating device may detect no negotiation advertisement and fall back to 10 Mbps half-duplex — resulting in very poor performance. Always configure both ends consistently: either both auto-negotiate, or both are manually set to the same speed and duplex. Mixed configuration (one auto, one manual) is a frequent source of slow network connections that are difficult to diagnose.
Full-duplex mode allows a device to transmit and receive simultaneously on separate wire pairs. This eliminates collisions entirely and effectively doubles throughput compared to half-duplex. Full-duplex requires a switch (not a hub) because a hub broadcasts to all devices, preventing true full-duplex operation. All modern Ethernet connections on switches should run full-duplex.
Switch vs. Hub Operation
The shift from hubs to switches is the most important change in Ethernet history after the shift from bus to star topology. Understanding the difference explains most of the performance improvements in modern networks.
A hub is a simple device that repeats every received signal out all other ports. All devices connected to a hub share a single collision domain — any two devices can collide with each other, and CSMA/CD must manage access. The bandwidth of the shared medium is divided among all devices. A 10 Mbps hub with 8 ports provides each device with an average of 10/8 = 1.25 Mbps when all are transmitting simultaneously.
A switch maintains a table of MAC addresses and which port each address is on. When a frame arrives, the switch looks up the destination MAC address in its table and forwards the frame only to the port that MAC address is on. Frames from different pairs of devices can traverse the switch simultaneously without interference. Each port on a switch has its own collision domain, and with full-duplex, there is no collision domain at all. A gigabit switch with 8 ports can simultaneously provide 1 Gbps in each direction on all 8 ports — dramatically better than a hub.
When building a network, always prefer switches over hubs. Even old, slow switches provide better performance and reliability than hubs for most modern uses.
Basic Ethernet Troubleshooting
Link lights (LEDs on the network port) are the first diagnostic tool. A lit link LED indicates the physical connection is established. A blinking activity LED indicates data is being transmitted. No link LED means no physical connection — check the cable, the connectors, and whether both devices are powered.
A cable tester checks that all conductors are correctly wired and connected. Most cable problems are connector problems: misaligned conductors, incomplete crimping, or a broken wire at a connector. The tester shows which pairs are correct and which have faults.
Ping is the simplest connectivity test above the physical layer. If the physical connection is up, ping tests whether IP routing is working correctly. No response to ping with a working physical link usually means IP address misconfiguration or a firewall blocking ICMP.
For performance problems, check for duplex mismatch (one end auto, one end manual), excessive collisions (indicating either heavy load on a hub-based segment or a malfunctioning device), and cable quality (long runs, damaged cables, or low-quality cables can cause high error rates that show up as retransmissions and poor throughput).