Frame Format

Part of Networking

How data is structured at the link layer for transmission across a network.

Why This Matters

A frame is the fundamental unit of data transmission on a network link. Raw bits flowing over a wire have no meaning unless both sender and receiver agree on how to interpret them. Frame format defines exactly how bits are organized: where one message ends and another begins, how the sender and receiver identify themselves, how the payload length is indicated, and how errors are detected.

Understanding frame format matters for several reasons. Network analysis tools display raw frame contents, and interpreting them requires knowing the structure. Protocol implementation requires building and parsing frames correctly. Debugging network problems often means examining frames to see what was actually transmitted versus what was expected. And the frame format encodes the fundamental design decisions of a network protocol — understanding why a format is designed as it is reveals the tradeoffs the designers made.

The frame concept generalizes across all link-layer protocols. Ethernet, Wi-Fi, HDLC, PPP, and every other data link protocol uses frames, though the specific format differs. Once you understand one frame format deeply, understanding others is much easier.

Ethernet Frame Structure in Detail

The Ethernet II (DIX) frame format is the standard in modern networks. Walking through each field shows why it exists and what it accomplishes.

Preamble (7 bytes): Seven bytes of alternating 1s and 0s: 10101010 repeated seven times. This pattern is not data — it is a synchronization signal that allows the receiver’s clock recovery circuit to lock onto the transmitter’s timing. Early Ethernet hardware needed time to synchronize; the preamble provides that time. Even modern hardware retains the preamble for compatibility, though current circuits synchronize almost instantly.

Start Frame Delimiter (1 byte): The value 10101011 — identical to a preamble byte except the last two bits are 11 instead of 10. This single byte transition from alternating bits to two consecutive 1s is an unambiguous “frame starts now” signal. The receiver watches for this pattern to know when to begin storing bits as frame data.

Destination MAC Address (6 bytes): The 48-bit hardware address of the intended recipient. The receiver checks this address against its own address; if they match (or if the destination is the broadcast address FF:FF:FF:FF:FF:FF), the frame is processed. If they do not match, the frame is discarded. This addressing happens in hardware at full line speed.

The most significant bit of the first destination address byte indicates whether the address is unicast (0) or multicast (1). The broadcast address is a special multicast address where all bits are 1. Multicast addresses in the range 01:00:5E:xx:xx:xx are used for IP multicast.

Source MAC Address (6 bytes): The 48-bit hardware address of the sender. This allows the receiver to send replies, and allows switches to learn which port each address is attached to.

EtherType / Length (2 bytes): Values 1536 and above are EtherType codes identifying the payload protocol. Common values: 0x0800 (IPv4), 0x0806 (ARP), 0x86DD (IPv6), 0x8100 (VLAN-tagged frame). Values 1500 and below are length fields in the original 802.3 format, indicating the number of data bytes in the payload. The transition value 1501-1535 is technically undefined; modern software uses EtherType format exclusively.

Payload (46-1500 bytes): The actual data being transported. The minimum of 46 bytes is required for CSMA/CD timing; shorter payloads are padded to 46 bytes. The maximum of 1500 bytes is the standard Ethernet MTU. Jumbo frames with larger MTUs (typically 9000 bytes) are supported by most modern hardware but must be explicitly configured.

Frame Check Sequence (4 bytes): The CRC-32 checksum of everything from the destination address through the end of the payload. The receiver computes the CRC of the received frame and compares it to this field. A mismatch means the frame was corrupted in transit and the frame is discarded. This field is computed and checked entirely in hardware and is transparent to software.

802.1Q VLAN Tagging

The 802.1Q standard adds a 4-byte tag between the source MAC address and the EtherType field. This tag identifies which VLAN the frame belongs to, allowing a single physical network to carry multiple logically separated networks.

The 802.1Q tag consists of: a 2-byte Tag Protocol Identifier (always 0x8100, which signals to the receiver that a tag follows), a 3-bit Priority Code Point (for Quality of Service prioritization), a 1-bit Drop Eligible Indicator, and a 12-bit VLAN Identifier (0-4095, with 0 and 4095 reserved).

VLAN tagging changes the maximum frame size from 1518 bytes (1500 payload + 14 header + 4 CRC) to 1522 bytes. Network equipment must support these extended frames, and links that carry tagged frames must be configured to accept the larger size.

LLC and SNAP Headers

The 802.3 format with length fields uses LLC (Logical Link Control) headers within the payload to identify the payload protocol, since there is no EtherType field. LLC headers add 3 bytes: DSAP (Destination Service Access Point), SSAP (Source Service Access Point), and Control. For many protocols, DSAP and SSAP are followed by a 5-byte SNAP (Sub-Network Access Protocol) header that includes a 3-byte OUI and the 2-byte EtherType, effectively duplicating the EtherType mechanism in a more complex structure.

In practice, LLC/SNAP is encountered mainly in legacy equipment and certain protocols (like spanning tree bridge protocol). New installations use Ethernet II format exclusively. If you see frames with 0xAA/0xAA/0x03 in the first three payload bytes, you are looking at LLC/SNAP encapsulation.

Reading Frame Dumps

Network analyzers like Wireshark capture and display frames. A typical Ethernet frame dump shows each field in hex with a decoded interpretation alongside. The hex display helps identify bit patterns; the decoded display provides the human-readable interpretation.

A sample frame header in hex:

ff ff ff ff ff ff   (destination: broadcast)
00 1a 2b 3c 4d 5e   (source MAC address)
08 00               (EtherType: IPv4)

The payload begins at byte 14 (offset 0x0E) and contains the encapsulated IP packet. The CRC at the end is usually stripped by the network interface before passing the frame to the operating system — most frame dumps do not show the CRC.

Understanding frame format enables you to read these dumps fluently, identify protocol types from EtherType values, spot malformed frames (wrong lengths, invalid CRC), and trace data from one layer to the next as it is encapsulated and de-encapsulated through the protocol stack.