Theory Networking

Frames

Layer 2 data units encapsulating packets with MAC addresses for local network delivery

Frames

  • Frames are Layer 2 data units that encapsulate Layer 3 packets for transmission across a single network segment
  • Think of frames as envelopes - they contain addressing information (MAC addresses) needed for local delivery, regardless of the packet contents inside
  • Each Layer 2 technology has its own frame format (Ethernet, Wi-Fi, PPP, Frame Relay, etc.)

Ethernet Frame Structure

  • Most common frame type in modern networks
  • Standard Ethernet II frame format is used for TCP/IP networks (as opposed to older 802.3 formats)
Field Size Purpose
Preamble 7 bytes Synchronization pattern (10101010)
SFD (Start Frame Delimiter) 1 byte Marks frame beginning (10101011)
Destination MAC 6 bytes Target device’s hardware address
Source MAC 6 bytes Sending device’s hardware address
EtherType/Length 2 bytes Protocol type (0x0800 for IPv4) or frame length
Data/Payload 46-1500 bytes Layer 3 packet plus padding if needed
FCS (Frame Check Sequence) 4 bytes CRC-32 error detection

Frame Size Considerations

  • Minimum frame size: 64 bytes (including headers, excluding preamble/SFD)
  • Maximum frame size: 1518 bytes (standard Ethernet)
  • Jumbo frames: Up to 9000 bytes (non-standard, must be supported end-to-end)
  • Runt frames: Smaller than 64 bytes (usually collision fragments)
  • Giant frames: Larger than maximum allowed size

Frame Processing Logic 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

Frame Processing at Switch

Incoming Frame
      ↓
[Read Dest MAC]
      ↓
[Check MAC Table]
      ↓
   Found | Not Found
      ↓       ↓
  [Forward] [Flood]
   to Port   All Ports
      ↓       ↓
[Learn Source MAC]
      ↓
   Complete
  • Devices examine the destination MAC address to determine if frame is intended for them
  • Unicast: Single destination MAC (first bit of first octet = 0)
  • Broadcast: All 1’s destination MAC (FF:FF:FF:FF:FF:FF)
  • Multicast: Group destination MAC (first bit of first octet = 1, but not broadcast)

For example, a switch will:

  1. Receive frame on ingress port
  2. Learn source MAC address and associate with ingress port
  3. Look up destination MAC in MAC address table
  4. Forward out appropriate port(s) or flood if unknown

Frame Types by Technology

Technology Max Frame Size Addressing Use Case
Ethernet 1518 bytes 48-bit MAC LAN segments
Wi-Fi (802.11) 2312 bytes 48-bit MAC Wireless LANs
PPP 1500 bytes No MAC addressing Point-to-point links
Frame Relay 4096 bytes (typical) DLCI addressing WAN connections

Vocabulary

  • Frame Check Sequence (FCS): CRC-32 calculation for error detection (not correction)
  • EtherType: Identifies the protocol of the encapsulated packet (IPv4, IPv6, ARP, etc.)
  • MAC Address Table: Switch’s database mapping MAC addresses to physical ports
  • CSMA/CD: Carrier Sense Multiple Access with Collision Detection (legacy half-duplex Ethernet)

Notes

  • Modern switched Ethernet networks operate in full-duplex mode, eliminating collisions and the need for CSMA/CD
  • Frames are only relevant within a single broadcast domain - routers strip Layer 2 headers and create new frames for each hop
  • When troubleshooting, remember that frame errors (CRC, runt, giant) typically indicate physical layer problems (ba