What is inside a frame?

Before the frame

A frame on the wire is preceded by 7 bytes of alternating ones and zeros, the preamble, and one start byte, 10101011. They give the receiver something to lock on to, and the start byte marks where the frame proper begins. The hardware adds them when it sends and strips them when it receives, and they are not counted in the frame's length.

Who it is for, who it is from

The frame opens with the destination address, 6 bytes, then the source address, 6 more. A radio call keeps the same order: "Bravo, this is Alpha", the station called first and the caller second.

Next come 2 bytes of type or length. A value up to 1500 is a length, the number of bytes of data that follow. A value of 1536 (0600h) or more is a type, naming what the payload is: 0800h for IPv4, 0806h for ARP, 86DDh for IPv6.

The payload and the padding

The payload holds up to 1500 bytes. If the data is shorter than 46 bytes, padding fills the payload out to 46, so the frame never falls under its minimum. A 10-byte message goes out with 36 bytes of padding.

Counted from the destination address to the check, a normal frame runs from 64 to 1518 bytes. A VLAN tag, where a network uses one, adds 4. A message over 1500 bytes does not fit in one frame.

The check

The frame ends with the frame check sequence, a 4-byte CRC worked out over everything from the destination address to the end of the padding. The receiver works out the same CRC over what arrived and compares. One flipped bit is enough to make them differ.

When they differ, the frame is thrown away, and Ethernet itself never asks for it again. Whether the data is sent again is up to the layers above Ethernet, the subject of TCP and UDP. A radio call has no check at the end, and that is where the radio picture bends most.

The Ethernet hardware normally adds the padding and the CRC when it sends and checks them when it receives, so the software hands over the addresses, the type and the data and leaves those two to the hardware. What that looks like on a board is in Ethernet instead of Wi-Fi.

Common mistakes

• Counting the preamble in the frame's length. The 64 and the 1518 run from the destination address to the check; the preamble and start byte come before and are not counted.
• Reading the type or length field as always a type. Up to 1500 it is a length; from 1536 up it is a type, such as 0800h for IPv4.
• Expecting Ethernet to resend a damaged frame. A frame whose check fails is dropped and nothing at the Ethernet layer asks for it again.