Ethernet Protocol

The definitive guide to IEEE 802.3 standards, frame structures, and physical layer characteristics for network engineers.

1. Historical Context: Why Ethernet Won

Before Ethernet became the universal standard, several competing technologies existed.

Token Ring (IEEE 802.5): Deterministic. A token passed around the ring granted permission to speak. No collisions, but expensive and complex to troubleshoot (if the ring broke, the network died).
FDDI (Fiber Distributed Data Interface): Dual-ring fiber topology. High speed (100Mbps) and resilient, but extremely costly.
Ethernet (IEEE 802.3): Started as a bus topology (Coax). It relied on CSMA/CD (Carrier Sense Multiple Access / Collision Detection). It was chaotic and non-deterministic, but it was cheap and easy to deploy on twisted pair cabling (10BaseT).

Engineer's Notebook: CSMA/CD is Dead

In modern switched networks, CSMA/CD is no longer used. Full Duplex links (dedicated Transmit/Receive pairs) mean collisions are impossible. CSMA/CD only applies to Half Duplex (Hubs/WiFi).

2. The Ethernet Frame

Ethernet frames encapsulate Layer 3 packets for transmission over a physical medium. The structure below represents the standard Ethernet II (DIX) frame used in modern TCP/IP networks.

Pre 1010.. 7B

SFD 1011 1B

Dest MAC MM:MM:MM:SS:SS:SS 6B

Src MAC MM:MM:MM:SS:SS:SS 6B

Type 0x0800 2B

Payload (L3 Packet) Data + Padding 46-1500B

FCS CRC 4B

Preamble & SFD: 8 bytes total used for hardware synchronization. Not technically part of the "frame" in packet captures (Wireshark strips them).
EtherType: Identifies the payload protocol. Common values:
- 0x0800: IPv4
- 0x0806: ARP
- 0x86DD: IPv6
- 0x8100: 802.1Q VLAN Tag
FCS: Frame Check Sequence (32-bit CRC). If the receiver calculates a different CRC than the one sent, the frame is silently dropped as an error.

2. Troubleshooting Physical Layer Issues

When interface counters increment errors, it usually points to specific Layer 1 problems.

Engineer's Notebook: Duplex Mismatch

A Duplex Mismatch is the #1 cause of "slow network" complaints on legacy links. It occurs when one side is forced to Full Duplex and the other is set to Auto.

Switch# show interfaces gigabitEthernet 1/0/1
...
Input errors: 0, CRC: 245, Frame: 0
Output errors: 0, Collisions: 0, Interface resets: 0
Late Collisions: 582  <-- HALLMARK OF DUPLEX MISMATCH

Why? The "Half Duplex" side detects traffic as a collision late in the transmission, causing packet loss and massive retransmissions.

Counter Dictionary

Counter	Meaning	Common Cause
Runts	Frame < 64 bytes	Collisions (Half Duplex) or bad NIC driver.
Giants	Frame > 1518 bytes	MTU Mismatch (Jumbo frames enabled on one end only).
CRC / FCS	Checksum failure	Bad cable, EMI interference, or loose connector.

3. MAC Addressing & OUI

The 48-bit MAC address is split into two 24-bit halves. The first half is the OUI (Organizationally Unique Identifier).

MAC:  00:0C:29 : 1A:2B:3C
      |______/   \______|
         OUI      Vendor Assigned
      (VMware)

Bit Significance: The first byte (e.g., 00) has two special bits:

I/G (Individual/Group): 0 = Unicast, 1 = Multicast.
U/L (Universal/Local): 0 = Burned-in (BIA), 1 = Locally Administered (Software).